joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4705e4
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [0x4bcbc0]
cmp dword [eax + 0x30], 0
je 0x47068e
cmp dword [ebx + 0x94], 0
jne 0x470688
mov eax, dword [ebx + 0x30]
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x470574
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x470688
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x47064e
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x470688
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.00418878
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x47065d
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x4711ec
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xa4], 0
je 0x471221
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00404f74
jmp 0x47122e
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.00404ed8
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x4723e8
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x472429
mov eax, esi
call fcn.00458258
test al, al
je 0x472429
mov eax, dword [ebx + 0x84]
call fcn.00457f54
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x472429
push 0
mov eax, dword [ebx + 0x84]
call fcn.00457f54
push eax
call sub.user32.dll_ShowWindow
pop esi
pop ebx
ret
Function at 0x472f28
Capabilities:
Create process on windows
Query environment variable

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdc8
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x238], ecx
mov dword [ebp - 0x234], ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], edx
mov esi, eax
xor eax, eax
push ebp
push 0x473184
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00404e84
lea eax, [ebp - 8]
mov edx, 0x104
call fcn.004054ec
push 0x104
lea eax, [ebp - 8]
call fcn.004053b8
push eax
push 0x473194
call sub.kernel32.dll_GetEnvironmentVariableA
mov edx, eax
lea eax, [ebp - 8]
call fcn.004054ec
mov eax, dword [ebp - 8]
call fcn.00405160
test eax, eax
jle 0x473159
lea eax, [ebp - 0x220]
xor ecx, ecx
mov edx, 0x44
call fcn.00403618
mov dword [ebp - 0x220], 0x44
mov dword [ebp - 0x1f4], 1
mov word [ebp - 0x1f0], 0
lea edx, [ebp - 0x10]
mov eax, 0x4731a4
call fcn.0040ed9c
lea eax, [ebp - 0x10]
call fcn.00472eb8
lea eax, [ebp - 0xc]
mov edx, 8
call fcn.004054ec
mov ebx, 1
lea eax, [ebp - 0xc]
call fcn.004053b8
lea eax, [eax + ebx - 1]
push eax
mov eax, 0x1a
call fcn.00403638
add al, 0x61
pop edx
mov byte [edx], al
inc ebx
cmp ebx, 9
jne 0x472ffa
lea eax, [ebp - 0xc]
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 0x10]
call fcn.004051ac
lea eax, [ebp - 0x230]
push eax
lea eax, [ebp - 0x220]
push eax
push 0
push 0
push 0x210
push 0
push 0
push 0
push dword [ebp - 8]
push 0x4731b4
push esi
push 0x4731c4
push dword [ebp - 0xc]
push 0x4731d4
lea eax, [ebp - 0x234]
mov edx, 6
call fcn.00405220
mov eax, dword [ebp - 0x234]
call fcn.00405360
push eax
push 0
call sub.kernel32.dll_CreateProcessA
test eax, eax
je 0x4730cd
xor eax, eax
push ebp
push 0x4730c6
push dword fs:[eax]
mov dword fs:[eax], esp
push 0xffffffffffffffff
mov eax, dword [ebp - 0x230]
push eax
call sub.kernel32.dll_WaitForSingleObject
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4730cd
mov eax, dword [ebp - 0x230]
push eax
call sub.kernel32.dll_CloseHandle_1
mov eax, dword [ebp - 0x22c]
push eax
call sub.kernel32.dll_CloseHandle_1
ret
mov edx, dword [ebp - 0xc]
lea eax, [ebp - 0x1dc]
call fcn.004032fc
lea eax, [ebp - 0x1dc]
call fcn.0040308c
lea edx, [ebp - 8]
lea eax, [ebp - 0x1dc]
call fcn.00403788
lea eax, [ebp - 0x1dc]
call fcn.004037f4
mov eax, dword [ebp - 4]
push dword [eax]
push dword [ebp - 8]
push 0x4731e0
mov eax, dword [ebp - 4]
mov edx, 3
call fcn.00405220
lea eax, [ebp - 0x1dc]
call fcn.004035e0
test al, al
je 0x4730e6
lea eax, [ebp - 0x1dc]
call fcn.00403478
mov eax, dword [ebp - 0xc]
call fcn.00409ad4
lea edx, [ebp - 0x238]
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call fcn.00472eec
mov edx, dword [ebp - 0x238]
mov eax, dword [ebp - 4]
call fcn.00404ed8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47318b
lea eax, [ebp - 0x238]
mov edx, 2
call fcn.00404ea8
lea eax, [ebp - 0x10]
mov edx, 3
call fcn.00404ea8
ret
Function at 0x479b70
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebx
push ecx
mov dword [esp], eax
mov eax, edx
dec eax
test eax, eax
jb 0x479ba3
inc eax
mov edx, dword [esp]
movzx edx, byte [edx]
mov ebx, dword [ecx]
and ebx, 0xff
xor edx, ebx
mov edx, dword [edx*4 + 0x4ba100]
mov ebx, dword [ecx]
shr ebx, 8
xor edx, ebx
mov dword [ecx], edx
inc dword [esp]
dec eax
jne 0x479b7d
pop edx
pop ebx
ret

Function at 0x479c5c
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeec
push ebx
push esi
xor eax, eax
mov dword [ebp - 0x114], eax
mov dword [ebp - 0x110], eax
mov dword [ebp - 0x10c], eax
mov dword [ebp - 0x108], eax
mov dword [ebp - 0x104], eax
mov esi, dword [0x4bb3c0]
xor eax, eax
push ebp
push 0x479ec8
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, esi
xor eax, eax
call fcn.00402f14
mov eax, dword [esi]
call fcn.00405160
mov ebx, eax
dec ebx
mov eax, dword [esi]
cmp byte [eax + ebx - 1], 0x5c
jne 0x479cad
push esi
mov eax, dword [esi]
mov ecx, ebx
mov edx, 1
call fcn.004053c0
push 0xff
lea eax, [ebp - 0x100]
push eax
call sub.kernel32.dll_GetSystemDirectoryA
mov eax, dword [0x4bb514]
lea edx, [ebp - 0x100]
mov ecx, pe_nt_image_headers32
call fcn.004050f4
mov eax, dword [0x4bb514]
call fcn.00479c28
push 0xff
lea eax, [ebp - 0x100]
push eax
call sub.kernel32.dll_GetWindowsDirectoryA
mov eax, dword [0x4bb5c0]
lea edx, [ebp - 0x100]
mov ecx, pe_nt_image_headers32
call fcn.004050f4
mov eax, dword [0x4bb5c0]
call fcn.00479c28
lea edx, [ebp - 0x104]
mov eax, 0x479ee0
call fcn.0040ed9c
mov edx, dword [ebp - 0x104]
mov eax, dword [0x4bb798]
call fcn.00404ed8
mov eax, dword [0x4bb798]
call fcn.00479c28
xor eax, eax
push ebp
push 0x479e17
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x4bba20]
mov eax, dword [eax]
mov edx, 0x80000001
call fcn.00435a14
mov edx, dword [0x4bb4ec]
mov edx, dword [edx]
lea eax, [ebp - 0x108]
mov ecx, 0x479ef0
call fcn.004051ac
mov edx, dword [ebp - 0x108]
mov eax, dword [0x4bba20]
mov eax, dword [eax]
xor ecx, ecx
call fcn.00435a78
lea ecx, [ebp - 0x10c]
mov eax, dword [0x4bba20]
mov eax, dword [eax]
mov edx, 0x479f10
call fcn.00435c60
mov edx, dword [ebp - 0x10c]
mov eax, dword [0x4bb6f0]
call fcn.00404ed8
mov eax, dword [0x4bb6f0]
call fcn.00479c28
lea ecx, [ebp - 0x110]
mov eax, dword [0x4bba20]
mov eax, dword [eax]
mov edx, 0x479f20
call fcn.00435c60
mov edx, dword [ebp - 0x110]
mov eax, dword [0x4bb9dc]
call fcn.00404ed8
mov eax, dword [0x4bb9dc]
call fcn.00479c28
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x479e1e
mov eax, dword [0x4bba20]
mov eax, dword [eax]
call fcn.004359e4
ret
Function at 0x47ac60
Capabilities:
Check os version
Create process on windows
Shutdown system

Disassembly:
add esp, 0xffffff44
mov dword [esp + 0x28], 0x94
lea eax, [esp + 0x28]
push eax
call sub.kernel32.dll_GetVersionExA
cmp dword [esp + 0x2c], 5
jne 0x47aca2
cmp dword [esp + 0x30], 1
jne 0x47aca2
push 0
push 0
push 0x47ada8
push 0x47adb4
push 0
push 0
call sub.shell32.dll_ShellExecuteA
jmp 0x47ada1
mov eax, dword [0x4bba64]
cmp dword [eax], 2
jne 0x47ad8a
xor eax, eax
mov dword [esp + 4], eax
push esp
push 0x28
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.advapi32.dll_OpenProcessToken
test eax, eax
jne 0x47ace0
push 0
push 0x47adc0
push 0x47add8
push 0
call sub.user32.dll_MessageBoxA_1
jmp 0x47ada1
push esp
push 0x28
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.advapi32.dll_OpenProcessToken
test eax, eax
jne 0x47ad0a
push 0
push 0x47adc0
push 0x47add8
push 0
call sub.user32.dll_MessageBoxA_1
jmp 0x47ada1
lea eax, [esp + 0xc]
push eax
push 0x47ade4
push 0
call sub.advapi32.dll_LookupPrivilegeValueA
test eax, eax
jne 0x47ad34
push 0
push 0x47adf8
push 0x47add8
push 0
call sub.user32.dll_MessageBoxA_1
jmp 0x47ada1
mov dword [esp + 8], 1
mov dword [esp + 0x14], 2
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x1c]
push eax
push 0x10
lea eax, [esp + 0x14]
push eax
push 0
mov eax, dword [esp + 0x14]
push eax
call sub.advapi32.dll_AdjustTokenPrivileges
call sub.kernel32.dll_GetLastError_1
test al, al
je 0x47ad7f
push 0
push 0x47ae14
push 0x47add8
push 0
call sub.user32.dll_MessageBoxA_1
jmp 0x47ada1
push 0
push 0xc
call sub.user32.dll_ExitWindowsEx
jmp 0x47ada1
push 0
push 0
push 0x47ae34
push 0x47ae4c
push 0
push 0
call sub.shell32.dll_ShellExecuteA
add esp, 0xbc
ret
Function at 0x48fb18
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
mov edi, eax
and edi, 0xfffffff
xor edx, edx
xor esi, esi
or edx, 1
mov ecx, esi
shl ecx, 3
mov ebx, edi
shr ebx, cl
xor eax, eax
mov ecx, eax
mov ebp, ebx
shr ebp, cl
and ebp, 1
xor edx, ebp
inc eax
cmp eax, 8
jne 0x48fb36
add edx, edx
inc esi
cmp esi, 3
jne 0x48fb28
or edx, 1
mov ebx, edi
shr ebx, 0x18
xor eax, eax
mov ecx, eax
mov esi, ebx
shr esi, cl
and esi, 1
xor edx, esi
inc eax
cmp eax, 4
jne 0x48fb59
shl edx, 0x1c
or edi, edx
mov eax, edi
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x48fb78
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov byte [esp], 1
xor edi, edi
mov ecx, 0x1f
sub ecx, edi
mov ebx, eax
shr ebx, cl
and ebx, 1
mov ecx, edi
shl ecx, 3
mov esi, eax
shr esi, cl
xor edx, edx
mov ecx, edx
mov ebp, esi
shr ebp, cl
and ebp, 1
xor ebx, ebp
inc edx
cmp edx, 8
jne 0x48fb9c
test ebx, ebx
je 0x48fbdf
inc edi
cmp edi, 3
jne 0x48fb83
mov ebx, eax
shr ebx, 0x1c
and ebx, 1
mov esi, eax
shr esi, 0x18
xor edx, edx
mov ecx, edx
mov eax, esi
shr eax, cl
and eax, 1
xor ebx, eax
inc edx
cmp edx, 4
jne 0x48fbc6
test ebx, ebx
je 0x48fbdf
mov byte [esp], 0
mov al, byte [esp]
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x498960
Capabilities:
Create process on windows
Query environment variable

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa0
xor edx, edx
mov dword [ebp - 0x60], edx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405350
xor eax, eax
push ebp
push 0x498a92
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
mov edx, 0x104
call fcn.004054ec
push 0x104
lea eax, [ebp - 8]
call fcn.004053b8
push eax
push 0x498aa0
call sub.kernel32.dll_GetEnvironmentVariableA
mov edx, eax
lea eax, [ebp - 8]
call fcn.004054ec
mov eax, dword [ebp - 8]
call fcn.00405160
test eax, eax
jle 0x498a6f
lea eax, [ebp - 0x4c]
xor ecx, ecx
mov edx, 0x44
call fcn.00403618
mov dword [ebp - 0x4c], 0x44
mov dword [ebp - 0x20], 1
mov word [ebp - 0x1c], 0
lea eax, [ebp - 0x5c]
push eax
lea eax, [ebp - 0x4c]
push eax
push 0
push 0
push 0x210
push 0
push 0
push 0
push dword [ebp - 8]
push 0x498ab0
push dword [ebp - 4]
lea eax, [ebp - 0x60]
mov edx, 3
call fcn.00405220
mov eax, dword [ebp - 0x60]
call fcn.00405360
push eax
push 0
call sub.kernel32.dll_CreateProcessA
test eax, eax
je 0x498a6f
xor eax, eax
push ebp
push 0x498a68
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x800
mov eax, dword [ebp - 0x5c]
push eax
call sub.kernel32.dll_WaitForSingleObject
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x498a6f
mov eax, dword [ebp - 0x5c]
push eax
call sub.kernel32.dll_CloseHandle_1
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_CloseHandle_1
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x498a99
lea eax, [ebp - 0x60]
call fcn.00404e84
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404ea8
ret
Function at 0x4a9bac
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
push esi
push edi
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4a9da1
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x4bb3e8]
cmp byte [eax], 0
je 0x4a9d39
mov eax, dword [0x4bb6d8]
cmp byte [eax], 0
je 0x4a9d39
mov eax, dword [0x4bba64]
cmp dword [eax], 2
jne 0x4a9cfe
mov eax, dword [ebx + 0x34c]
mov edx, dword [eax]
call dword [edx + 0xc8]
test al, al
je 0x4a9c27
mov eax, dword [ebx + 0x3b4]
mov edx, dword [eax]
call dword [edx + 0xc8]
test al, al
je 0x4a9c27
lea eax, [ebp - 4]
mov edx, 0x4a9db8
call fcn.00404f1c
jmp 0x4a9c34
lea eax, [ebp - 4]
mov edx, 0x4a9dc4
call fcn.00404f1c
mov eax, dword [0x4bac08]
call fcn.004099a4
test al, al
je 0x4a9c86
cmp ebx, esi
je 0x4a9c52
cmp esi, dword [ebx + 0x34c]
jne 0x4a9d39
push 1
mov eax, dword [0x4bb3c0]
mov eax, dword [eax]
call fcn.00405360
push eax
mov eax, dword [ebp - 4]
call fcn.00405360
push eax
mov eax, dword [0x4bac08]
call fcn.00405360
push eax
push 0x4a9dc8
push 0
call sub.shell32.dll_ShellExecuteA
jmp 0x4a9d39
mov edi, dword [ebx + 0x3b4]
push 0x4a9dd8
push dword [0x4bac08]
push 0x4a9de8
lea eax, [ebp - 8]
mov edx, 3
call fcn.00405220
mov eax, dword [ebp - 8]
push eax
lea eax, [ebp - 0xc]
mov ecx, 0x4a9dfc
mov edx, dword [0x4bac08]
call fcn.004051ac
mov eax, dword [ebp - 0xc]
pop edx
call fcn.0047626c
xor eax, eax
mov dword [edi + 0x120], eax
mov dword [edi + 0x124], eax
xor edx, edx
mov eax, edi
mov ecx, dword [eax]
call dword [ecx + 0xcc]
mov dword [edi + 0x124], ebx
mov dword [edi + 0x120], fcn.004a9bac
xor edx, edx
mov eax, edi
mov ecx, dword [eax]
call dword [ecx + 0x64]
jmp 0x4a9d39
cmp ebx, esi
je 0x4a9d0a
cmp esi, dword [ebx + 0x34c]
jne 0x4a9d39
mov eax, dword [ebx + 0x34c]
mov edx, dword [eax]
call dword [edx + 0xc8]
test al, al
je 0x4a9d2e
mov eax, dword [ebx + 0x3b4]
mov edx, dword [eax]
call dword [edx + 0xc8]
test al, al
jne 0x4a9d32
xor eax, eax
jmp 0x4a9d34
mov al, 1
call fcn.0047a468
cmp ebx, esi
je 0x4a9d45
cmp esi, dword [ebx + 0x34c]
jne 0x4a9d74
mov eax, dword [ebx + 0x34c]
mov edx, dword [eax]
call dword [edx + 0xc8]
test al, al
je 0x4a9d69
mov eax, dword [ebx + 0x3b4]
mov edx, dword [eax]
call dword [edx + 0xc8]
test al, al
je 0x4a9d6d
xor eax, eax
jmp 0x4a9d6f
mov al, 1
call fcn.0047a644
cmp byte [0x4bac14], 0
jne 0x4a9d86
mov dl, 1
mov eax, ebx
call fcn.0048fbe8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a9da8
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00404ea8
ret
Function at 0x4aba94
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov esi, edx
mov ebx, eax
mov eax, dword [ebx + 0x5a8]
call fcn.00451c3c
xor edx, edx
mov eax, dword [ebx + 0x39c]
call fcn.00463814
mov eax, dword [0x4bb770]
xor edx, edx
mov dword [eax], edx
cmp esi, dword [ebx + 0x364]
jne 0x4abb73
mov byte [0x4bf029], 1
call fcn.0047ccdc
mov eax, dword [0x4bb3ac]
mov eax, dword [eax]
mov edx, dword [eax]
call dword [edx + 0x44]
mov eax, dword [0x4bb76c]
mov eax, dword [eax]
xor edx, edx
call fcn.0047e4b0
mov eax, dword [0x4bb3ac]
mov eax, dword [eax]
mov edx, dword [eax]
call dword [edx + 0x14]
test eax, eax
jle 0x4abbbb
mov eax, dword [0x4bb7f8]
cmp byte [eax], 0
je 0x4abb29
mov eax, dword [0x4bb770]
mov dword [eax], 1
mov eax, dword [0x4bb76c]
mov eax, dword [eax]
xor edx, edx
call fcn.0047e4b0
jmp 0x4abbbb
mov byte [0x4bf028], 1
xor ecx, ecx
mov dl, 1
mov eax, dword [0x47c6a8]
call fcn.00469e40
mov edx, dword [0x4bb76c]
mov dword [edx], eax
mov eax, dword [0x4bb76c]
mov eax, dword [eax]
mov edx, dword [eax]
call dword [edx + 0xec]
mov eax, dword [0x4bb76c]
call fcn.0040ea24
push 0
mov eax, dword [0x4bb750]
mov eax, dword [eax]
mov eax, dword [eax + 0x30]
push eax
call sub.user32.dll_ShowWindow
jmp 0x4abbbb
mov byte [0x4bf028], 1
xor ecx, ecx
mov dl, 1
mov eax, dword [0x47c6a8]
call fcn.00469e40
mov edx, dword [0x4bb76c]
mov dword [edx], eax
mov eax, dword [0x4bb76c]
mov eax, dword [eax]
mov edx, dword [eax]
call dword [edx + 0xec]
mov eax, dword [0x4bb76c]
call fcn.0040ea24
push 0
mov eax, dword [0x4bb750]
mov eax, dword [eax]
mov eax, dword [eax + 0x30]
push eax
call sub.user32.dll_ShowWindow
mov byte [0x4bf029], 0
mov byte [0x4bf028], 0
mov dl, 1
mov eax, dword [ebx + 0x39c]
call fcn.00463814
mov eax, dword [ebx + 0x5a8]
call fcn.00451c44
pop esi
pop ebx
ret
Function at 0x407010
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
push ebx
push esi
push edi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
movzx ebx, word [ecx + 6]
add eax, 0x18
add eax, ecx
test ebx, ebx
je 0x40704e
mov edi, dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
cmp edi, esi
jb 0x407046
mov ecx, dword [eax + 8]
add ecx, esi
cmp edi, ecx
jb 0x407050
inc edx
add eax, 0x28
cmp edx, ebx
jb 0x407036
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x407120
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
mov eax, 0x5a4d
cmp word [ecx], ax
jne 0x407151
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x407151
mov ecx, 0x10b
cmp word [eax + 0x18], cx
jne 0x407151
mov eax, 1
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x407080
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x5000]
push edi
or ebp, 0xffffffff
jmp 0x4070a2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x4070a9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x407098
mov eax, 1
add ebx, ebx
jne 0x4070bb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x4070b0
jne 0x4070cc
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4070b0
xor ecx, ecx
sub eax, 3
jb 0x4070e0
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x407152
mov ebp, eax
add ebx, ebx
jne 0x4070eb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x4070f8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x40711c
inc ecx
add ebx, ebx
jne 0x407108
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x4070fd
jne 0x407119
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4070fd
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x40713c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x40712d
jmp 0x40709e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x40713c
add edi, ecx
jmp 0x40709e
pop esi
mov edi, esi
mov ecx, 0x78
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x40715a
cmp byte [edi], 0
jne 0x40715a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov eax, ebx
loop 0x40715f
lea edi, [esi + 0x5000]
mov eax, dword [edi]
or eax, eax
je 0x4071d7
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x784c]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x78d8]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x40718c
mov ecx, edi
jns 0x4071bb
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x78dc]
or eax, eax
je 0x4071d1
mov dword [ebx], eax
add ebx, 4
jmp 0x4071a9
call dword [esi + 0x78e0]
popal
jmp section.UPX0
Function at 0x4ecf10
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, 0x279000
lea edi, [esi - 0x98000]
push edi
jmp 0x4ecf2a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x4ecf31
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4ecf20
mov eax, 1
add ebx, ebx
jne 0x4ecf43
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x4ecf54
jne 0x4ecf73
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4ecf73
dec eax
add ebx, ebx
jne 0x4ecf60
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x4ecf38
add ebx, ebx
jne 0x4ecf6f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x4ecfc5
xor ecx, ecx
sub eax, 3
jb 0x4ecf8b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x4ecffa
sar eax, 1
mov ebp, eax
jmp 0x4ecf96
add ebx, ebx
jne 0x4ecf96
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4ecf64
inc ecx
add ebx, ebx
jne 0x4ecfa4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4ecf64
add ebx, ebx
jne 0x4ecfb1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x4ecfa6
jne 0x4ecfc2
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4ecfa6
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x4ecfe4
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x4ecfd6
jmp 0x4ecf26
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x4ecfe4
add edi, ecx
jmp 0x4ecf26
pop esi
mov edi, esi
mov ecx, 0x3ed9
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x4ed002
cmp byte [edi], 0x11
jne 0x4ed002
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x4ed007
lea edi, [esi + 0xe5000]
mov eax, dword [edi]
or eax, eax
je 0x4ed07f
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x1017ec]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x101968]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x4ed034
mov ecx, edi
jns 0x4ed063
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x10196c]
or eax, eax
je 0x4ed079
mov dword [ebx], eax
add ebx, 4
jmp 0x4ed051
call dword [esi + 0x10197c]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x4ed0b0
cmp al, 0xef
ja 0x4ed0a3
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x4ed085
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x4ed092
mov ebp, dword [esi + 0x101970]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x227]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x4ed0e4
sub esp, 0xffffff80
jmp 0x425f74
Function at 0x407281
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x461124], 0
jne 0x4072bf
xor ecx, ecx
push esi
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
movzx edx, dl
neg edx
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x407295
mov dword [ecx*4 + 0x461120], eax
inc ecx
cmp ecx, 0x100
jl 0x407290
pop esi
cmp dword [ebp + 0x10], 0
mov eax, dword [ebp + 8]
not eax
jbe 0x4072ec
mov ecx, dword [ebp + 0xc]
movzx edx, byte [ecx]
dec dword [ebp + 0x10]
xor edx, eax
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x461120]
inc ecx
cmp dword [ebp + 0x10], 0
ja 0x4072cd
not eax
pop ebp
ret 0xc

Function at 0x710c8c
Capabilities:
Encode data using xor

Disassembly:
mov ebx, 0x7109ec
sub esi, 0x1d3adb97
mov esi, esi
call fcn.00710cbf
add esi, esi
xor dword [ecx], ebx
mov edx, 0xbb629f03
sub edx, edx
add edx, edx
inc ecx
inc esi
cmp ecx, edi
jne fcn.00710c8c
mov esi, 0xc4a8315f
or esi, edx
ret