joyce8/EMBER2024-capa huggingface dataset:
Function at 0x406040
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x208
mov eax, dword [esp + 0x20c]
push ebx
push ebp
mov ebp, dword [esp + 0x218]
push esi
push edi
push ebp
push 0
push 0
push eax
push 0xe4784c
mov edi, ecx
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov esi, eax
cmp esi, 0x20
ja 0x406132
lea ecx, [esp + 0x10]
push ecx
push 0xe47844
push SysReAllocStringLen
mov ecx, edi
call fcn.00405de0
test eax, eax
jne 0x406132
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea edx, [esp + 0x10]
push 0xe47830
push edx
call ebx
lea eax, [esp + 0x10]
lea ecx, [esp + 0x10]
push eax
push ecx
push SysReAllocStringLen
mov ecx, edi
call fcn.00405de0
test eax, eax
jne 0x406132
lea edx, [esp + 0x10]
push 0xe47828
push edx
call fcn.00416b30
mov esi, eax
add esp, 8
test esi, esi
jne 0x406103
lea eax, [esp + 0x10]
push 0xe47824
push eax
call fcn.00416ab0
mov esi, eax
add esp, 8
test esi, esi
jne 0x406103
lea ecx, [esp + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea esi, [esp + eax + 0xf]
jmp 0x406106
mov byte [esi], 0
push 0xe47820
push esi
call ebx
mov edx, dword [esp + 0x21c]
push edx
push esi
call ebx
lea eax, [esp + 0x10]
push ebp
push eax
call dword [sym.imp.KERNEL32.dll_WinExec]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x208
ret 8
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x208
ret 8
Function at 0x408e60
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x436b50
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
mov eax, dword [0xe47e48]
push ebx
push esi
push edi
mov esi, ecx
mov dword [esp + 0xc], eax
mov dword [esp + 0x28], 0
mov dword [esp + 0x10], eax
lea eax, [esp + 0x10]
lea ecx, [esp + 0xc]
push eax
mov ebx, 1
push ecx
mov ecx, esi
mov byte [esp + 0x30], bl
call fcn.00408b30
test eax, eax
je 0x408ebb
mov edx, dword [esp + 0xc]
mov eax, dword [edx - 8]
test eax, eax
jne 0x408eee
lea ecx, [esp + 0x10]
mov byte [esp + 0x28], 0
call fcn.00429f93
lea ecx, [esp + 0xc]
mov dword [esp + 0x28], 0xffffffff
call fcn.00429f93
xor eax, eax
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
add esp, 0x20
ret
lea edi, [esi + 0x94]
lea eax, [esp + 0xc]
push eax
mov ecx, edi
call fcn.0042a0cc
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push edi
call fcn.00429d08
push ecx
mov byte [esp + 0x30], 2
mov ecx, esp
mov dword [esp + 0x20], esp
push 0xe478e4
call fcn.0042a001
push ecx
mov byte [esp + 0x34], 3
mov ecx, esp
mov dword [esp + 0x28], esp
push 0xe47bd8
call fcn.0042a001
mov ecx, 0xe4c0b8
mov byte [esp + 0x34], bl
call fcn.00402670
mov ecx, esi
mov dword [esi + 0x98], ebx
mov dword [esi + 0x9c], ebx
mov dword [esi + 0xa0], ebx
call fcn.00407730
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push edi
call fcn.00429d08
mov ecx, esi
call fcn.00407a10
mov ecx, esi
call fcn.00408060
push 0x87
lea ecx, [esi + 0x168]
call fcn.0042d3b7
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push 0xe47934
call fcn.0042a001
mov ecx, 0xe4c0b8
call fcn.00402380
push 0
mov ecx, esi
call fcn.0042ca62
mov ecx, 0xe4c0b8
call fcn.00402820
push 0
mov ecx, 0xe4c0b8
call fcn.00402a30
lea ecx, [esp + 0x10]
mov byte [esp + 0x28], 0
call fcn.00429f93
lea ecx, [esp + 0xc]
mov dword [esp + 0x28], 0xffffffff
call fcn.00429f93
mov ecx, dword [esp + 0x20]
pop edi
mov eax, ebx
pop esi
mov dword fs:[0], ecx
pop ebx
add esp, 0x20
ret
Function at 0x40a890
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x437010
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
push ebx
push esi
mov eax, dword [0xe47e48]
mov dword [esp + 0x30], 0
mov dword [esp + 8], eax
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], eax
mov bl, 3
mov esi, 1
mov byte [esp + 0x30], bl
push esi
push 0xe47a38
push 0x400
lea ecx, [esp + 0x14]
call fcn.0042a3ae
push eax
call fcn.004162cd
add esp, 0xc
lea ecx, [esp + 8]
push 0xffffffffffffffff
call fcn.0042a3fd
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push 0xe47a30
call fcn.0042a001
push ecx
lea eax, [esp + 0x10]
mov ecx, esp
mov dword [esp + 0x28], esp
push eax
mov byte [esp + 0x3c], 4
call fcn.00429d08
push ecx
lea edx, [esp + 0x44]
mov ecx, esp
mov dword [esp + 0x30], esp
push edx
mov byte [esp + 0x40], 5
call fcn.00429d08
lea eax, [esp + 0x20]
mov ecx, 0xe4c0b8
push eax
mov byte [esp + 0x40], bl
call fcn.00402590
push eax
lea ecx, [esp + 0x14]
mov byte [esp + 0x34], 6
call fcn.0042a0cc
lea ecx, [esp + 0x14]
mov byte [esp + 0x30], bl
call fcn.00429f93
mov ecx, dword [esp + 0x10]
mov eax, dword [ecx - 8]
test eax, eax
je 0x40aa2f
push esi
push 0xe47a20
push 0x400
lea ecx, [esp + 0x14]
call fcn.0042a3ae
push eax
call fcn.004162cd
add esp, 0xc
lea ecx, [esp + 8]
push 0xffffffffffffffff
call fcn.0042a3fd
push ecx
mov ecx, esp
mov dword [esp + 0x28], esp
push 0xe4c18c
call fcn.0042a001
push ecx
lea edx, [esp + 0x10]
mov ecx, esp
mov dword [esp + 0x28], esp
push edx
mov byte [esp + 0x3c], 7
call fcn.00429d08
push ecx
lea eax, [esp + 0x44]
mov ecx, esp
mov dword [esp + 0x28], esp
push eax
mov byte [esp + 0x40], 8
call fcn.00429d08
lea ecx, [esp + 0x24]
mov byte [esp + 0x3c], bl
push ecx
mov ecx, 0xe4c0b8
call fcn.00402590
push eax
lea ecx, [esp + 0x10]
mov byte [esp + 0x34], 9
call fcn.0042a0cc
lea ecx, [esp + 0x18]
mov byte [esp + 0x30], bl
call fcn.00429f93
mov edx, dword [esp + 0xc]
mov eax, dword [edx - 8]
test eax, eax
je 0x40aa2f
push 0x400
lea ecx, [esp + 0x10]
call fcn.0042a3ae
push 0xffffffffffffffff
lea ecx, [esp + 0x10]
call fcn.0042a3fd
inc esi
jmp 0x40a8ce
lea ecx, [esp + 0xc]
mov byte [esp + 0x30], 2
call fcn.00429f93
lea ecx, [esp + 0x10]
mov byte [esp + 0x30], 1
call fcn.00429f93
lea ecx, [esp + 8]
mov byte [esp + 0x30], 0
call fcn.00429f93
lea ecx, [esp + 0x38]
mov dword [esp + 0x30], 0xffffffff
call fcn.00429f93
mov ecx, dword [esp + 0x28]
pop esi
mov eax, 1
mov dword fs:[0], ecx
pop ebx
add esp, 0x2c
ret 4
Function at 0x425eb0
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov esi, dword [ebp + 0x10]
push 0xf00021
mov edx, dword [esi + 4]
mov ecx, dword [esi]
mov eax, dword [esi + 0xc]
sub eax, edx
push eax
mov eax, dword [esi + 8]
sub eax, ecx
push eax
push edx
push ecx
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.GDI32.dll_PatBlt]
mov edi, dword [ebp + 8]
push edi
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
mov ebx, eax
lea eax, [eax + 5]
add eax, 3
and eax, 0xfffffffc
call fcn.00416320
mov dword [ebp - 4], esp
cmp dword [ebp - 4], 0
je 0x425f7b
add ebx, 2
mov eax, dword [ebp - 4]
push ebx
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowTextA]
test eax, eax
je 0x425f7b
mov bx, 0x140
mov edi, dword [ebp + 0x14]
mov eax, edi
and al, 0xf
cmp al, 0xc
je 0x425f2e
mov ebx, edi
and bx, 0xf
or bx, 0x150
test edi, 0x80
je 0x425f39
or bh, 8
and edi, 0x8000000
je 0x425f54
mov eax, dword [0xe4fe5c]
mov ecx, dword [ebp + 0xc]
push eax
push ecx
call dword [sym.imp.GDI32.dll_SetTextColor]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + 0xc]
movzx eax, bx
push eax
push esi
push 0xffffffffffffffff
push ecx
push edx
call dword [sym.imp.USER32.dll_DrawTextA]
test edi, edi
je 0x425f7b
mov eax, dword [ebp - 8]
mov ecx, dword [ebp + 0xc]
push eax
push ecx
call dword [sym.imp.GDI32.dll_SetTextColor]
lea esp, [ebp - 0x14]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x426350
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword [esp + 8]
sub esp, 4
push ebx
push esi
mov esi, dword [esp + 0x10]
push edi
push ebp
push 2
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
test edi, edi
jne 0x42637b
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret 0x20
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebx, eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
test esi, esi
jne 0x42639f
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret 0x20
push ebx
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebp, eax
test ebp, ebp
jne 0x4263ba
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret 0x20
mov edi, ebp
mov ecx, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [esp + 0x20]
xor ecx, ecx
mov cl, ah
mov edx, eax
mov dword [esp + 0x10], 0
shl ecx, 8
shr edx, 0x10
mov byte [esp + 0x10], dl
xor edx, edx
or ecx, dword [esp + 0x10]
mov dl, al
shl edx, 0x10
mov eax, dword [esp + 0x28]
or ecx, edx
mov edx, eax
shr edx, 0x10
mov dword [ebp + 0x28], ecx
mov dword [esp + 0x10], 0
xor ecx, ecx
mov byte [esp + 0x10], dl
mov cl, ah
xor edx, edx
shl ecx, 8
mov dl, al
shl edx, 0x10
or ecx, dword [esp + 0x10]
or ecx, edx
mov eax, dword [esp + 0x24]
mov edx, eax
mov dword [ebp + 0x44], ecx
shr edx, 0x10
xor ecx, ecx
mov dword [esp + 0x10], 0
mov cl, ah
mov byte [esp + 0x10], dl
shl ecx, 8
xor edx, edx
or ecx, dword [esp + 0x10]
mov dl, al
shl edx, 0x10
mov eax, dword [esp + 0x2c]
or ecx, edx
xor edx, edx
mov dl, al
mov dword [ebp + 0x48], ecx
shl edx, 0x10
xor ecx, ecx
mov cl, ah
shl ecx, 8
shr eax, 0x10
or ecx, edx
xor edx, edx
mov dl, al
mov eax, dword [esp + 0x30]
or ecx, edx
xor edx, edx
mov dl, al
mov dword [ebp + 0x64], ecx
shl edx, 0x10
xor ecx, ecx
mov cl, ah
shl ecx, 8
shr eax, 0x10
or ecx, edx
xor edx, edx
mov dl, al
mov eax, dword [esp + 0x34]
or ecx, edx
xor edx, edx
mov dl, al
mov dword [ebp + 0x54], ecx
shl edx, 0x10
xor ecx, ecx
mov cl, ah
shl ecx, 8
push 0
shr eax, 0x10
or ecx, edx
xor edx, edx
mov dl, al
or ecx, edx
mov dword [ebp + 0x50], ecx
call dword [sym.imp.USER32.dll_GetDC]
mov edi, eax
push 0
push ebp
lea ecx, [ebp + 0x68]
push ecx
push 4
push ebp
push edi
call dword [sym.imp.GDI32.dll_CreateDIBitmap]
mov esi, eax
push edi
push 0
call dword [sym.imp.USER32.dll_ReleaseDC]
push ebp
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, esi
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret 0x20
Function at 0x42ccd3
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x42cd15
call fcn.00432ce1
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x42cd15
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x42cd0c
xor eax, eax
jmp 0x42cd1d
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.0042cd23
pop edi
pop esi
pop ebx
ret 4

Function at 0x42e0d1
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, 0x437d40
call fcn.00417110
sub esp, 0x18
push ebx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x1c], esi
mov eax, dword [esi + 0x48]
mov edi, dword [esi + 0x44]
mov dword [ebp - 0x18], eax
call fcn.00432ce1
cmp dword [esi + 0x40], 0
mov ebx, dword [eax + 0xc]
je 0x42e110
call fcn.00432ce1
mov ebx, dword [eax + 0xc]
push 5
push dword [esi + 0x40]
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x42e11e
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jne 0x42e12c
or eax, 0xffffffff
jmp 0x42e214
mov ecx, esi
call fcn.0042e047
mov dword [ebp - 0x14], eax
call fcn.0042b312
xor edi, edi
cmp dword [ebp - 0x14], edi
mov dword [ebp - 0x20], edi
je 0x42e163
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_IsWindowEnabled]
test eax, eax
je 0x42e163
push edi
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_EnableWindow]
mov dword [ebp - 0x20], 1
push esi
mov dword [ebp - 4], edi
call fcn.0042b2c6
push dword [ebp - 0x14]
call fcn.0042adf7
push ebx
push eax
push dword [ebp - 0x18]
mov ecx, esi
call fcn.0042dddf
cmp eax, edi
je 0x42e1d6
test byte [esi + 0x24], 0x10
je 0x42e1a4
push 4
mov ecx, esi
pop ebx
call fcn.0042a5ca
test ah, 1
je 0x42e19c
push 5
pop ebx
push ebx
mov ecx, esi
call fcn.0042ce25
cmp dword [esi + 0x1c], edi
je 0x42e1d6
push 0x97
push edi
push edi
push edi
push edi
push edi
mov ecx, esi
call fcn.0042a712
jmp 0x42e1d6
or dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x20], edi
je 0x42e1ea
push 1
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_EnableWindow]
cmp dword [ebp - 0x14], edi
je 0x42e203
call dword [sym.imp.USER32.dll_GetActiveWindow]
cmp eax, dword [esi + 0x1c]
jne 0x42e203
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_SetActiveWindow]
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x58]
mov ecx, esi
call fcn.0042e081
mov eax, dword [esi + 0x2c]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret
Function at 0x433005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
call 0x43300c
pop eax
nop
nop
nop
nop
nop
nop
add eax, 0x40a063
sub eax, 0x40a009
nop
nop
nop
nop
nop
mov ebx, dword [eax]
nop
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x433030
nop
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
jne 0x43301e
nop
popal
nop
nop
nop
nop
jmp 0x431219
Function at 0x427e10
Capabilities:
Authenticate hmac

Disassembly:
mov dl, 0xea
jl 0x427e84
adc bh, ch
mov edi, 0xb3c3d725
and dl, byte [ebx]
mov al, byte [0xe38658f9]
inc esp
mov ebp, 0xd5103568
pop eax
sti
lahf
imul esi, dword [edx + 0x4eed235], 0x3f19b43d
and ecx, edx
mov esp, 0xa17ab05c
adc byte [eax - 0x67c732ca], ah
cld
push 0xa8108166
sahf
push cs
mov ch, 0x5d
in al, 0x49
stc
mov al, byte [0x23ccb4a4]
mov al, byte [0x35f9c0]
pop edi
lcall 0xeaa0, 0xd609b816
jle 0x427ecd
mov al, 0xa5
mov eax, dword [0x8485b50c]
out 0x5c, al
leave
mov edi, 0xa408c120
dec esi
lodsd eax, dword [esi]
push esi
shr dh, cl
into
and byte [ebp - 0x5f2fd0f8], ch
adc ah, byte [ecx + 0x1765bfd0]
mov edi, 0xb8f21765
add dword [eax - 0x2f189cf1], ebp
mov eax, 0x630fa801
out 0xd0, eax
add eax, 0xa5b8efa1
movsd dword es:[edi], dword [esi]
lodsd eax, dword [esi]
adc edx, 7
invalid
xor dword [edx], 0xffffffcf
in al, dx
shl byte [eax - 0x2032c83e], cl
mov word [eax], es
stc
rcl edi, 0xb1
adc ah, dl
or edi, eax
jp 0x427e59
lahf
int1
dec ebp
std
dec edi
pop esi
mov edi, edx
pop esp
iretd
scasd eax, dword es:[edi]
mov byte [0x402d5084], al
push 0xffffffffffffff8e
cmp bl, bh
push 0x6c
loope 0x427e81
sahf
cmp esi, ecx
lds eax, [esi]
mov dh, dh
xor dword [esi + 0x2e0ea6be], eax
mov word [ebx], ds
push cs
mov word cs:[ebx], ds
jno 0x427ead
sbb cl, dh
add eax, 0xfcc9ef07
clc
ror ah, cl
xchg dword [esi], esi
jnp 0x427f2d
sub byte [esp + ebp*2 + 0x72821644], 0x13
out 0x19, eax
les eax, [eax + eax + 0x5e]
loope 0x427ee8
lds edi, [edi + 0x20cc431]
xchg dword [ebx + 0x45], ebx
shl dword [ebp + ecx - 0x51e1cb5d], 1
stosb byte es:[edi], al
lds edx, [edx - 0x5a]
ljmp 0x729f
pop eax
pop eax
sub al, 0x36
push esi
sub ch, byte [esi + ebx - 0x67]
test dword [0xafc2c1bc], ecx
inc esp
bound ebx, qword [edx]
fld xword [esi + edx*4 - 0x7ec51bd6]
mov ch, byte [ecx - 0x78]
invalid

Function at 0x43eb3c
Capabilities:
Encode data using xor

Disassembly:
nop
xchg edx, eax
adc byte [esi + 0x54e08008], cl
test eax, 0x7453fe0a
aaa
xchg ebx, eax
inc ebx
aad 0x89
dec edi
jno 0x43eb70
invalid
xor esp, dword [ebx - 0x3860e38c]
mov dword [0xc79f1c74], eax
lodsb al, byte [esi]
mov byte [0x7e6cf0e7], al
mov dh, 0x5c
fst st(2)
cld
mov al, byte [0xd8590cb3]
adc dl, byte [ebx + 0x1f]
mov word [esp + ebx*4 + 0x7cf06698], cs
dec ebp
mov al, byte [0x6426ce05]
and esp, edx
inc ebp
shl dword [ebx], 1
mov al, byte [0x81237ada]
test dword [eax + 0x45], 0x8d4024f9
sub cl, byte [ebp + 0x55]
and al, 0x40
lea ebp, [edx]
dec ebp
push ebp
mov byte [eax - 0x6f6a5ef7], al
sbb eax, 0xb421b683
jns 0x43eb28
mov eax, dword [0xa26cc309]
xchg dword [ebp + 2], esp
xchg edi, eax
adc eax, dword [edi - 0x4b]
fild word [eax]
jo 0x43eb4c
invalid
Function at 0x4505cd
Capabilities:
Encode data using xor

Disassembly:
sub ah, bh
push eax
jne 0x4505ce
fsubr st(5), st(0)
in al, dx
jo 0x4505e7
call 0x659ccc4f
xchg esi, eax
fstpnce st(1), st(0)
stosb byte es:[edi], al
popal
invalid
popal
sbb byte [esi - 0x2d], dl
mov byte [ebp + 0x25], dl
xor al, 0xd
mov bh, 0xca
ja 0x450613
pop edi
nop
loopne 0x4505e7
imul edi, eax, 7
push ds
cmp eax, 0x5de29118
mov eax, 0x3c810623
sub al, 0x3d
push es
int 0xe0
push esp
pop eax
sbb dword [esi + 0x50ee5468], 0x71
invalid
jno 0x450569
lcall 0x3738, 0xeb63b190
bound eax, qword [ebp + edi + 0x76147055]
imul ecx, dword [edi - 0x2c], 0xfffffff8
aam 0x70
bound esi, qword [eax + esi - 0xf]
push 0xffffffffffffffb9
invalid
nop
mov cl, 0x63
jmp 0x45060c
mov ecx, 0x350e8c4
lodsd eax, dword [esi]
mov al, 0x5a
jl 0x450624
stosd dword es:[edi], eax
xchg esi, eax
insb byte es:[edi], dx
push ss
jbe 0x45064f
mov al, 0x64
cmp al, 0x34
or eax, 0xd7ed4f10
je 0x45065d
push ecx
and ebx, dword [ecx + edx - 0x3cf3c4db]
daa
jne 0x4505a1
xchg esp, eax
pushal
push ds
mov al, byte [0x44d282e0]
inc esp
mov dword [0x77307547], eax
je 0x45067f
sub eax, 0x9381a314
movsd dword es:[edi], dword [esi]
ja 0x45062e
xchg esi, eax
push cs
pop ebx
jbe 0x450637
sbb eax, 0xdabd4eaf
inc ecx
and al, 0xb1
sub byte [esi + 0x36], ch
sbb al, 0x1b
sar dword [esi + ecx + 0x30], 1
aad 0x28
jno 0x450658
push cs
xor ch, dl
sbb edx, dword [esi + eax*8 + 0x45e266bb]
cli
daa
and esp, dword [ebx + 0xf702bb5]
jo 0x45065a
cmpsd dword [esi], dword es:[edi]
test byte [ecx], dh
jae 0x4505ec
pushfd
and al, 0x51
and al, 0x54
push esi
xchg ebp, eax
xchg edx, eax
add ch, byte [esi]
das
das
add cl, dh
cmp al, 0x70
ljmp 0x79
jo 0x450649
jb 0x45063c
pushfd
xor eax, 0xb1170079
pop ebx
inc ebx
cmpsd dword [esi], dword es:[edi]
jo 0x450687
jb 0x4506a7
mov dl, 0x24
sub dword [edi], edi
popal
je 0x4506b4
imul eax, dword [esi - 0xfceeea2], 0x820060b4
add al, 0x2e
scasb al, byte es:[edi]
add byte [esi + ebp], 0xae
clc
sub ecx, dword [edx]
fnsave dword [ebx - 0x3eacacdd]
insb byte es:[edi], dx
jl 0x450708
mov bl, 0x23
push ebx
push ebx
shr dword [esp + edi*2 + 0x79], 0x24
mov eax, dword [0x94b7c512]
and al, 0xa1
adc al, ch
mov bh, 0x94
scasb al, byte es:[edi]
mov ebx, 0x27b61f95
add byte [ebp*4 + 0x70273aad], bh
in eax, 0x30
and eax, 0x11b93cda
adc dword [esi], edi
xchg esp, eax
mov ecx, 0x4d943e11
test dword [ebx], esp
sub byte [ecx - 0x71], cl
fbld tbyte [eax + 0x69269176]
sal dword [ebp - 0x1e6b8cbf], 1
adc dh, byte [ecx]
dec edi
out 0x57, al
jae 0x450659
jae 0x4506f0
sub eax, 0xa1d9a185
mov dword [0xfd0b4035], eax
test al, 9
mov word [edx + 0xd38682a], cs
inc esi
jp 0x450720
jl 0x4506c3
mov byte [0xa8401277], al
and byte [0x48e21d6f], dh

Function at 0x472dbe
Capabilities:
Encode data using xor

Disassembly:
div ch
jae 0x472d81
add ebx, dword [ecx]
stc
rcr byte [ecx], 1
cmp al, 0x7c
Function at 0x40a5b0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x7000]
push edi
or ebp, 0xffffffff
jmp 0x40a5d2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x40a5d9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x40a5c8
mov eax, 1
add ebx, ebx
jne 0x40a5eb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x40a5e0
jne 0x40a5fc
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x40a5e0
xor ecx, ecx
sub eax, 3
jb 0x40a610
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x40a682
mov ebp, eax
add ebx, ebx
jne 0x40a61b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x40a628
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x40a64c
inc ecx
add ebx, ebx
jne 0x40a638
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x40a62d
jne 0x40a649
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x40a62d
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x40a66c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x40a65d
jmp 0x40a5ce
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x40a66c
add edi, ecx
jmp 0x40a5ce
pop esi
mov edi, esi
mov ecx, 0x138
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x40a68a
cmp byte [edi], 4
jne 0x40a68a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x40a68f
lea edi, [esi + 0x8000]
mov eax, dword [edi]
or eax, eax
je 0x40a6fe
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xa6cc]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xa758]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x40a6bc
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xa75c]
or eax, eax
je 0x40a6f8
mov dword [ebx], eax
add ebx, 4
jmp 0x40a6d9
call dword [esi + 0xa764]
mov ebp, dword [esi + 0xa760]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1d7]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x40a732
sub esp, 0xffffff80
jmp section.UPX0
Function at 0x402cc8
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [section.DATA]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x402d60
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x402d40
xor eax, eax
push ebp
push 0x402d39
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x402d7c
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x402d40
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [section.DATA]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [section.DATA], ax
mov esp, ebp
pop ebp
ret