joyce8/EMBER2024-capa huggingface dataset:
Function at 0x414b40
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0xe000]
push edi
or ebp, 0xffffffff
jmp 0x414b62
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x414b69
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x414b58
mov eax, 1
add ebx, ebx
jne 0x414b7b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x414b70
jne 0x414b8c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x414b70
xor ecx, ecx
sub eax, 3
jb 0x414ba0
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x414c12
mov ebp, eax
add ebx, ebx
jne 0x414bab
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x414bb8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x414bdc
inc ecx
add ebx, ebx
jne 0x414bc8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x414bbd
jne 0x414bd9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x414bbd
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x414bfc
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x414bed
jmp 0x414b5e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x414bfc
add edi, ecx
jmp 0x414b5e
pop esi
mov edi, esi
mov ecx, 0x43b
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x414c1a
cmp byte [edi], 0
jne 0x414c1a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x414c1f
lea edi, [esi + 0x12000]

Function at 0xee8638
Capabilities:
Encode data using xor

Disassembly:
jmp 0xee8642
or eax, dword [eax]
add byte [eax], al
add byte [eax], al
pushal
call 0xee8648
pop ebp
sub ebp, 0x10
sub ebp, 0xae8638
jmp 0xee865e
mov eax, 0xae8638
add eax, ebp
add eax, 0x4c
mov ecx, 0x5c8
mov edx, 0x36a75e94
xor byte [eax], dl
inc eax
dec ecx
jne 0xee8675
jmp 0xee8688
pop ds
pop ecx
pop ds
sbb eax, 0x949494a8
adc eax, 0x94946c55
xchg esp, eax
xchg edi, eax
pop ecx
sub al, 0x91
xchg esp, eax
xchg esp, eax
xchg esp, eax
mov esp, 0x63949494
jbe 0xee863c
pop esp
pop ds
adc eax, 0x94949498
xchg edi, eax
push ecx
les ebx, [ecx]
invalid
Function at 0x3ff01000
Capabilities:
Allocate or change rwx memory
Check for software breakpoints
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [str.99j9ttu_jao]
mov ecx, dword [0x3ff59014]
mov edx, dword [0x3ff59018]
mov dword [ebp - 0x10], eax
mov al, byte [0x3ff5901c]
mov dword [ebp - 0xc], ecx
mov ecx, dword [str.eeDe774aD_o]
mov byte [ebp - 4], al
mov eax, dword [0x3ff59028]
mov dword [ebp - 8], edx
mov edx, dword [0x3ff59024]
mov dword [ebp - 0x20], ecx
mov cl, byte [0x3ff5902c]
push ebx
xor bl, bl
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x1c], edx
mov byte [ebp - 0x14], cl
xor eax, eax
mov dl, byte [ebp + eax - 0x20]
mov cl, byte [ebp + eax - 0x10]
xor cl, dl
mov byte [ebp + eax - 0x10], cl
inc eax
cmp eax, 0xd
jb 0x3ff01050
push 0
push 0x4000000
push 3
push 0
push 0
lea eax, [ebp - 0x10]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov cl, byte [ebp - 0x20]
mov dword [0x3ffac340], eax
xor eax, eax
mov dl, byte [ebp + eax - 0x10]
xor dl, cl
mov byte [ebp + eax - 0x10], dl
inc eax
cmp eax, 0xd
jb 0x3ff01087
mov eax, dword [0x3ff657f4]
test eax, eax
jne 0x3ff01147
mov eax, dword [ebp + 4]
mov dword [0x3ff657ec], eax
mov eax, dword [0x3ff657ec]
mov dl, 0x5a
mov cl, byte [eax]
cmp cl, 0xca
jne 0x3ff010d7
cmp byte [eax + 1], 0xed
jne 0x3ff010d7
cmp byte [eax + 2], 0x97
jne 0x3ff010d7
cmp byte [eax + 3], 0xcc
jne 0x3ff010d7
cmp byte [eax + 4], 0xff
jne 0x3ff010d7
cmp byte [eax + 5], dl
je 0x3ff010e1
add bl, cl
inc eax
mov dword [0x3ff657ec], eax
jmp 0x3ff010b3
add eax, 8
xor ecx, ecx
mov dword [0x3ff657ec], eax
mov dword [0x3ff657f4], ecx
mov dl, byte [ecx + eax]
cmp dl, 0xca
jne 0x3ff01115
cmp byte [ecx + eax + 1], 0xed
jne 0x3ff01115
cmp byte [ecx + eax + 2], 0x97
jne 0x3ff01115
cmp byte [ecx + eax + 3], 0xcc
jne 0x3ff01115
cmp byte [ecx + eax + 4], 0xff
je 0x3ff01118
inc ecx
jmp 0x3ff010eb
push 0x3ff657f0
add ecx, 8
push 0x40
add eax, 0xfffffff8
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov ecx, dword [0x3ff657ec]
mov byte [ecx - 3], 0xa5
mov ebx, dword [0x3ff657ec]
mov ecx, dword [0x3ff657f4]
sub ecx, 5
int3
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x3ff011c0
Capabilities:
Delete file

Disassembly:
mov eax, dword [esp + 8]
cmp eax, 3
ja case.default.0x3ff011cd
jmp dword [eax*4 + 0x3ff01260]
call fcn.3ff46690
call section..text
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 4]
push eax
push 1
push ecx
call int.3ff17730
add esp, 0xc
mov eax, 1
ret 0xc
mov edx, dword [esp + 0xc]
mov eax, dword [esp + 4]
push edx
push 2
push eax
call sym.Zdvd.dll_private:_void___thiscall_C_MPEG2_Video_Algorithm::HMRR_bP_macroblock_void_
add esp, 0xc
mov eax, 1
ret 0xc
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 4]
push ecx
push 3
push edx
call sym.Zdvd.dll_private:_void___thiscall_C_MPEG2_Video_Algorithm::HMRR_bP_macroblock_void_
add esp, 0xc
mov eax, 1
ret 0xc
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 4]
push eax
push 0
push ecx
call fcn.3ff177a0
add esp, 0xc
push str..CCAD
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
call fcn.3ff466c0
mov eax, 1
ret 0xc
Function at 0x3ff18e50
Capabilities:
Encode data using xor

Disassembly:
add byte [edi], al
jo 0x3ff18df1
inc esi
inc edx
in eax, 0x44
jno 0x3ff18e05
xor dword [0xbcfc0012], ecx
not byte [ecx]
jb 0x3ff18ea7
movsb byte es:[edi], byte [esi]
xor byte [esi + 0x1d], bh
sbb dword [ecx], ebx
mov eax, dword [0xc8c91588]
enter 0xffffffffffffd9ee, 0x4c
cld
dec ecx
jmp 0xa0d990b0
jns 0x3ff18ee6
das
hlt
mov ah, 0xb6
mov dh, 0xef
and dword [ecx + 0xe9ddf3b], ebp
push ss
jge 0x3ff18f1d
and byte [ebx + 0x65], 0x58
test eax, 0x98a9a9a9
sub edi, dword [ebp - 0x37e8eb6]
in al, dx
in al, dx
push cs
mov bh, byte [edx + edi*2 - 3]
imul ebx, dword [ebx], 0x50
inc edi
sub eax, 0x406bbd7a
div esp
push ebx
xchg esp, eax
pop esi
in eax, dx
insd dword es:[edi], dx
insd dword es:[edi], dx
insd dword es:[edi], dx
or byte [esi - 0x53512d65], dh
lodsb al, byte [esi]
lodsb al, byte [esi]
salc
wait
shr byte [esi - 0x29535354], cl
sbb di, cx
enter 0xffffffffffffb166, 0xffffffffffffff85
sbb cl, byte [esi - 0x766431f]
xor bh, byte [edx - 0x4b]
xchg esp, eax
xchg ebx, eax
add byte [esi], bl
xor byte [eax], dh
xor byte [ecx + 5], al
sbb al, 0xb1
mov bl, 0xb3
sub ah, ch
invalid

Function at 0x3ff1a160
Capabilities:
Encode data using xor

Disassembly:
push ss
test al, 0xaf
stosb byte es:[edi], al
dec ecx
cmpsb byte [esi], byte es:[edi]
fidivr word [esi - 0x5f4322be]
push edx
stc
pop eax
cmpsd dword [esi], dword es:[edi]
lds eax, [edi*2 + 0x78f32315]
adc al, byte [esi]
in al, 0x59
xor eax, 0x40d79d64
adc dword [edi - 0xfed2f73], esi
add eax, 0x171e620f
insb byte es:[edi], dx
mov ch, 0x15
clc
jb 0x3ff1a170
mov eax, 0x98889160
dec edx
push 0x28
sub dword [ebx], ebp
das
daa
aaa
pop ss
push edi
Function at 0x3ff1f9c0
Capabilities:
Encode data using xor

Disassembly:
call 0xe26c7091
mov dword [0x11c75d67], eax
fstpnce st(1), st(0)
xor cl, byte [eax]
or eax, 0x13137714
div dl
inc ebx
inc ecx
rcl dword [ecx - 0x45baa4fa]
push es
pop ebx
inc ebp
mov edx, 0x5c1d869c
invalid
or ch, al
iretd
push es
pop ebx
inc ebp
mov edx, 0x5c1d869c
imul ecx, dword [edx], 0x1b6acfe8
outsb dx, byte [esi]
test bl, al
mov cl, 0xe8
rcl dword [ecx + 0x32e2856b]
jl 0x3ff1f7f7
push ss
xchg esi, eax
xchg esi, eax
out dx, al
mov edi, 0xccc5e3cb
xor esi, dword [ebx]
xor edi, dword [ebp - 0x7b35f07c]
xchg ecx, eax
adc bh, 0x8a
mov eax, 0x3df9cab0
test ecx, ebx
cmp eax, 0x6e6e6eff
wait
lcall 0x5858, 0x7875f7db
rol esp, 0xd8
and byte [eax - 0x54f6a76e], ch
je 0x3ff1f899
inc ebx
pop dword [ecx + eax*8]
invalid
rol al, 0xb1
inc edx
jbe 0x3ff1f8e1
jns 0x3ff1f8a2
dec ebp
pop esp
jg 0x3ff1f924
push esi
invalid
popal
out dx, al
and al, 0x34
push ds
push ds
push ds
cld
push eax
popfd
mov ch, 0x91
cmpsd dword [esi], dword es:[edi]
pop ebx
fdivr qword [ebx - 0x3c787d5]
adc al, 0x1f
ficom dword [ebp + ebx*8 - 0x1d5bd08c]
cmp dword [ebx + 0x67], edx
jns 0x3ff1f8ba
dec ebp
inc ecx
cmc
xor ah, byte [edi + 0x8080888]
frstor dword [esi]
popal
mov eax, 0x6b5590c3
stosb byte es:[edi], al
imul ecx, dword [eax - 0x549935ae], 0xffffff83
push edi
enter 0x42c5, 0x5c
mov bh, 0x71
and esp, dword [edi]
daa
jo 0x3ff1f984
neg esi
or byte [eax], ch
ja 0x3ff1f96b
sal ebx, cl
leave
mov al, byte [0x6adbb71e]
sub eax, 0x2fd0d05c
jg 0x3ff1f92c
adc al, 0xed
loop 0x3ff1f8eb
adc byte [ebx + 0x1b], ah
add dword [ebx - 0x40607079], 0x7c7e7fff
js 0x3ff1f9bd
pushal
inc eax
add ah, al
les ebp, [edi]
daa
loop 0x3ff1f901
in eax, 0x4c
call dword [edx]
or ch, byte [eax + esi*2]
outsd dx, dword [esi]
pop esp
and eax, dword [eax + 0x212fdeb3]
das
femms
push cs
push cs
invalid
lea ebx, [ebp + 0x57]
push edi
out dx, al
add bh, byte [0x66970dc]
scasd eax, dword es:[edi]
jg 0x3ff1f97f
pop ds
jne 0x3ff1f952
pushal
daa
and eax, 0x239e2525
scasd eax, dword es:[edi]
scasd eax, dword es:[edi]
scasd eax, dword es:[edi]
cmp edi, eax
rcl dword [ecx + edi + 0x39], cl
push edx
xor byte [edx], dl
mov edx, 0xa7c6c657
add eax, 0x2a29f830
clc
sub dword [edx], ebp
das
inc eax
mov dword [0x6d097230], eax
insd dword es:[edi], dx
aad 0xee
js 0x3ff1f959
aas
aas
add ah, al
xchg edx, ecx
test eax, 0xf1951e24
int1
push cs
mov eax, fs
xlatb
sbb byte [eax + 0x1a], ah
imul dword [edi + ebp*4 + 0x7b]
imul ecx, dword [ebx + 0xb], 0xffffffe0
stosd dword es:[edi], eax
fld qword [esi]
jle 0x3ff1f997
loop 0x3ff1f96d
mov cl, 0xbc
mov esp, 0x2094bcbc
sti
inc ecx
push 0xa9686868
invalid

Function at 0x3ff217c0
Capabilities:
Encode data using xor

Disassembly:
lcall 0x888a, 0x54d065df
mov byte [eax - 0x70cfb18b], cl
invalid
Function at 0x3ff21df0
Capabilities:
Encode data using xor

Disassembly:
jnp 0x3ff21e6e
or ebp, dword [ebp + eax*4 - 0x37c603af]
dec edi
push cs
stosd dword es:[edi], eax
push ecx
cmp dword [0xd7d7f7f8], eax
xlatb
xor eax, 0x4a0d0bc5
pop esp
sub al, 0x86
loope 0x3ff21e46
push ebp
cli
jae 0x3ff21dc1
push 0xb72bec4b
in eax, 0x9d
cdq
cdq
cdq
neg dword [ebx]
cmp edi, dword [ebx]
cmp esp, dword [edx + 0x3d]
mov fs, word [ecx]
pop edx
xchg esp, eax
pop ebx
retf
invalid
not bh
xlatb
inc eax
push ecx
cmp eax, 0x7018f9d1
xor dword [edi], esp
js 0x3ff21e6c
push ds
xlatb
mov ebx, 0xd5a5f9f2
fstp st(5)
invalid

Function at 0x3ff2a020
Capabilities:
Encode data using xor

Disassembly:
scasb al, byte es:[edi]
test eax, 0x92e833de
add dword [eax + 0x60d54f95], esp
push edi
cmc
mov esi, 0x16e24646
dec esp
dec esi
dec esi
lds esp, [ecx - 0x53]
stc
add byte [0x2020a55], ah
pop esi
inc eax
cdq
pop ecx
mov cl, 0x73
jge 0x3ff2a071
invalid
jmp [edx*2 - 0x792ebf13]

Function at 0x3ff378d0
Capabilities:
Encode data using xor

Disassembly:
or bh, byte [ebx + 0x507e1a59]
test byte [edi], al
inc ecx
test dword [esp + eax*4 + 0x614490aa], eax
pop es
xchg dword [edi + 0x3dc51790], eax
sbb eax, 0x55e03abd
mov esi, 0xdebbcaaa
pushfd
call 0xa171d4a5
inc esi
push es
stc
xchg dword [ecx], eax
pop es
loop 0x3ff378e3
jne 0x3ff37905
dec esp
xchg edx, eax
outsb dx, byte [esi]
arpl word [eax + 0x45], bp
cwde
fstp dword [eax + ebx*2 - 0x46]
popfd
jle 0x3ff3786c
jnp 0x3ff37942
pop edx
loop 0x3ff37915
xor ah, byte [esi + 0x68]
xchg ebx, eax
pushfd
pushfd
pushfd
mov ah, byte [esi - 0x19]
ret
mov bl, 0x33
xor dh, byte [eax]
xor al, 0x3c
sub al, 0xc
dec esp
pushal
cmp dword [esi + 0x1c], 0x6ebd641e
fistp qword [0xe0341a7e]
arpl word [0xcee0e0e1], sp
loope 0x3ff378f7
loopne 0x3ff378e7
hlt
pop esi
wait
aad 0x9c
out dx, eax
ljmp 0x552f

Function at 0x3ff379a0
Capabilities:
Check for software breakpoints

Disassembly:
mov ecx, 0xd6583681
add byte [eax], ch
fbld tbyte [ecx - 0x6906dfd9]
jno 0x3ff37a18
nop
fcmovnbe st(0), st(5)
mov dword [0xac12cc3c], eax
and ebx, esi
jle 0x3ff37969
adc dl, al
add byte [edx - 0x1f38fbae], dh
add byte [edx], 2
adc eax, 0xe502fa19
mov esp, 0x83838118
wait
xor al, 0x24
mov edx, dword [ebx - 0x73]
cmp ebx, ebx
invalid
push edx
lcall 0x5a00, 0xe222d00
fldl2e
jp 0x3ff379f6
inc edi
inc edi
scasd eax, dword es:[edi]
sbb eax, ebx
pop ecx
je 0x3ff37a86
push edi
pop ecx
cmp al, 0x84
mov bh, 0x35
inc esp
xlatb
mov cs, word [ebp + 0x6a6a6851]
ror dh, 0xd9
mov cl, 0xe5
retf
push 0xffffffffffffffc0
into
fnstenv [ecx - 0x4646341b]
je 0x3ff379fe
outsd dx, dword [esi]
test eax, 0xc4ef9fc4
cmp byte fs:[edi - 0x24752021], bl
mov al, byte [0xe39e979f]
xchg dl, cl
add dword [0x1f7e238], 0x4a
retf
mov cl, 0xf6
or eax, 0x81ef7c9c
add esi, edi
arpl dx, bp
stc
scasd eax, dword es:[edi]
int 0x4c
sub ah, byte [ecx - 0x64]
lahf
push edx
inc edx
xor byte [eax + 0x2c585d52], dl
int3
Function at 0x401400
Capabilities:
Get common file path
Get startup folder

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [esp + 0x10], 0x441030
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0x23
mov dword [esp], 0
call sub.SHELL32.DLL_SHGetFolderPathA
sub esp, 0x14
call sub.msvcrt.dll_rand
mov edx, eax
mov eax, edx
sar eax, 0x1f
shr eax, 0x1f
lea eax, [edx + eax]
sar eax, 1
add eax, eax
sub edx, eax
mov eax, edx
add eax, 5
mov dword [esp], eax
call sym.q90x9uy:ayu_I_Ez:_q92Iy_I_n:Wy:B:_vyby:_.:_ZuV_uZe
mov dword [esp + 4], 0x43e005
mov dword [esp], 0x441030
call sub.msvcrt.dll_strcat
mov dword [esp + 4], 0x43d000
mov dword [esp], 0x441030
call sub.msvcrt.dll_strcat
leave
ret

Function at 0x4015c0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [esp + 0x14], 1
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov eax, dword [ebp + 8]
mov dword [esp + 8], eax
mov dword [esp + 4], str.open
mov dword [esp], 0
call sub.SHELL32.DLL_ShellExecuteA
sub esp, 0x18
leave
ret
Function at 0x4040a0
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
call dword [sym.imp.KERNEL32.DLL_TlsAlloc]
cmp eax, 0xffffffff
je 0x4040d6
mov dword [0x4451d0], eax
mov edx, sym.2_Fy:C_Fy:z:vu9_x9u0_E__x9vwzxx9t9wzx9bxu__
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.0040cb80
test eax, eax
sete al
movzx eax, al
mov dword [0x43d0f0], eax
leave
ret
call dword [sym.imp.KERNEL32.DLL_GetLastError]
test eax, eax
sete al
movzx eax, al
mov dword [0x43d0f0], eax
leave
ret

Function at 0x4041c0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
lea eax, [ebp - 0xc]
sub esp, 0x68
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x40]
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], esi
mov dword [ebp - 4], edi
mov dword [ebp - 0x28], sym.iuu2_9q9wj_.ub_Imueaaxwj:yZy:a_xwj:yZy:
mov dword [ebp - 0x24], 0x43c6d4
mov dword [ebp - 0x1c], 0x404280
mov dword [ebp - 0x18], esp
mov dword [esp], eax
call fcn.0040d0f0
cmp dword [0x43d0f0], 0
mov dword [ebp - 0x44], 0x4451e0
je 0x404260
jl 0x4042a0
mov dword [ebp - 0x3c], 1
mov eax, dword [0x4451d0]
mov dword [ebp - 0x4c], eax
mov eax, dword [sym.imp.KERNEL32.DLL_GetLastError]
call eax
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x4c]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.DLL_TlsGetValue]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x50]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.DLL_SetLastError]
mov eax, dword [ebp - 0x54]
sub esp, 4
test eax, eax
mov dword [ebp - 0x48], eax
je 0x404343
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x44], eax
lea esi, [esi]
lea eax, [ebp - 0x40]
mov dword [esp], eax
call fcn.0040d1d0
mov eax, dword [ebp - 0x44]
mov ebx, dword [ebp - 0xc]
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
mov edx, dword [0x4457f0]
mov eax, 0xffffffff
test edx, edx
je 0x4042ba
mov eax, dword [0x43d0f4]
test eax, eax
je 0x4042fa
xor eax, eax
test eax, eax
jne 0x4042f0
mov edi, dword [0x43d0f0]
test edi, edi
js 0x4042f0
mov dword [ebp - 0x44], 0x4451e0
mov ebx, dword [0x43d0f0]
test ebx, ebx
je 0x404260
jmp 0x40420e
xor esi, esi
mov dword [0x43d0f0], esi
jmp 0x4042c8
mov dword [esp], 0x43d0f8
mov dword [ebp - 0x3c], 1
call sub.KERNEL32.DLL_InterlockedIncrement
sub esp, 4
test eax, eax
je 0x404381
mov eax, dword [0x43d0f4]
test eax, eax
jne 0x4042b8
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.DLL_Sleep]
mov dword [ebp - 0x3c], 1
call eax
sub esp, 4
mov eax, dword [0x43d0f4]
test eax, eax
je 0x40431d
jmp 0x4042b8
mov dword [esp], 8
call sub.msvcrt.dll_malloc
mov dword [ebp - 0x48], eax
test eax, eax
je 0x404375
mov dword [esp + 4], eax
mov eax, dword [0x4451d0]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.DLL_TlsSetValue]
sub esp, 8
xor edx, edx
test eax, eax
je 0x4043aa
test edx, edx
je 0x404395
mov dword [ebp - 0x3c], 1
call sym._wrxsHx9b
call sym.y:z:vu9_x9u0_E__x9vwzxx9t9wzx9bxu__x9xq9wz
mov eax, 1
mov dword [0x43d0f4], eax
jmp 0x4042b8
mov eax, dword [ebp - 0x48]
mov dword [eax], 0
mov dword [eax + 4], 0
jmp 0x404256
call dword [sym.imp.KERNEL32.DLL_GetLastError]
mov edx, eax
jmp 0x404371
Function at 0x4099f0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x1c
mov eax, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
mov esi, dword [ebp + 0x10]
mov dword [ebp - 0x10], eax
lea esi, [esi]
lea edi, [edi]
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sym.AsyI_r9w.I_z:_p_q9Ir9y:ur9wxg_yzuFx3x97_z:e1__y_w9e1__y
mov dword [esp], eax
mov dword [esp + 8], esi
mov dword [esp + 4], edi
call sub.msvcrt.dll__read
cmp eax, 0xffffffff
mov ebx, eax
jne 0x409a3c
call sub.msvcrt.dll__errno
cmp dword [eax], 4
je 0x409a10
add esp, 0x1c
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x40ca20
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov eax, 0x10
mov ebp, esp
push ebx
sub esp, 0x64
and esp, 0xfffffff0
call fcn.0040db40
call fcn.0040cc80
call sub.KERNEL32.DLL_GetCommandLineA
mov ebx, eax
lea eax, [ebp - 0x58]
mov dword [esp], eax
call sub.KERNEL32.DLL_GetStartupInfoA
sub esp, 4
test ebx, ebx
jne 0x40ca58
jmp 0x40caf6
inc ebx
movzx ecx, byte [ebx]
cmp cl, 0x20
sete al
cmp cl, 9
sete dl
or eax, edx
test al, 1
jne 0x40ca57
cmp cl, 0x22
je 0x40cab0
cmp cl, 0x20
setne al
xor edx, edx
cmp cl, 9
setne dl
test eax, edx
je 0x40cad0
lea esi, [esi]
lea edi, [edi]
test cl, cl
je 0x40cad0
inc ebx
movzx ecx, byte [ebx]
cmp cl, 0x20
setne al
xor edx, edx
cmp cl, 9
setne dl
test eax, edx
jne 0x40ca90
jmp 0x40cad0
inc ebx
movzx ecx, byte [ebx]
cmp cl, 0x22
setne al
xor edx, edx
test cl, cl
setne dl
test eax, edx
jne 0x40cab0
cmp cl, 0x22
je 0x40cb32
lea esi, [esi]
cmp cl, 0x20
sete al
cmp cl, 9
sete dl
jmp 0x40caf0
inc ebx
movzx ecx, byte [ebx]
cmp cl, 0x20
sete dl
cmp cl, 9
sete al
or eax, edx
test al, 1
jne 0x40cae0
mov dword [esp], 0
call sub.KERNEL32.DLL_GetModuleHandleA
sub esp, 4
test byte [ebp - 0x2c], 1
mov edx, 0xa
je 0x40cb14
movzx edx, word [ebp - 0x28]
mov dword [esp + 8], ebx
xor ebx, ebx
mov dword [esp + 4], ebx
mov dword [esp + 0xc], edx
mov dword [esp], eax
call sym.Wy:B:_vyby:_.:_ZuV_uZe_9xO::_ZurXy:un29B_tdx9e_
sub esp, 0x10
mov ebx, dword [ebp - 4]
leave
ret
inc ebx
movzx ecx, byte [ebx]
jmp 0x40cad0

Function at 0x40cfe0
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x14
mov ebx, dword [0x445850]
call dword [sym.imp.KERNEL32.DLL_TlsAlloc]
cmp eax, 0xffffffff
je 0x40d020
mov dword [ebx + 0x2c], eax
xor eax, eax
mov dword [esp + 4], eax
mov eax, dword [ebx + 0x2c]
mov dword [esp], eax
call fcn.0040cb80
test eax, eax
sete al
movzx eax, al
mov dword [ebx + 0x30], eax
add esp, 0x14
pop ebx
pop ebp
ret
call dword [sym.imp.KERNEL32.DLL_GetLastError]
test eax, eax
sete al
movzx eax, al
mov dword [ebx + 0x30], eax
add esp, 0x14
pop ebx
pop ebp
ret
Function at 0x430006
Capabilities:
Encode data using xor

Disassembly:
mov eax, section..pdata
nop
mov ebx, 0x408f6c
nop
mov ecx, 0x356635bd
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x43004e
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x430024
nop
nop
mov eax, section..pdata_1
nop
nop
mov ebx, 0x42e3d0
mov ecx, 0x4fe80f4c
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
je 0x430084
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
add eax, 4
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x43006c
nop
nop
nop
nop
nop
nop
popal
jmp 0x401219

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x427b60
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x21000]
push edi
or ebp, 0xffffffff
jmp 0x427b82
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x427b89
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x427b78
mov eax, 1
add ebx, ebx
jne 0x427b9b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x427b90
jne 0x427bac
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x427b90
xor ecx, ecx
sub eax, 3
jb 0x427bc0
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x427c32
mov ebp, eax
add ebx, ebx
jne 0x427bcb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x427bd8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x427bfc
inc ecx
add ebx, ebx
jne 0x427be8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x427bdd
jne 0x427bf9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x427bdd
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x427c1c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x427c0d
jmp 0x427b7e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x427c1c
add edi, ecx
jmp 0x427b7e
pop esi
mov edi, esi
mov ecx, 0x43b
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x427c3a
cmp byte [edi], 0
jne 0x427c3a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x427c3f
lea edi, [esi + 0x25000]

Function at 0x431000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43100c
nop
nop
nop
pop eax
nop
nop
add eax, 0x403e6a
nop
nop
sub eax, 0x403e10
nop
nop
nop
mov ebx, dword [eax]
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
jl 0x431030
nop
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
jne 0x43101e
nop
nop
nop
popal
nop
nop
nop
jmp fcn.00401219