joyce8/EMBER2024-capa huggingface dataset:
Function at 0x458e30
Capabilities:
Receive data
Receive data on socket
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x28], ebx
mov ebx, ecx
mov esi, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x458f7a
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00458458
xor eax, eax
push ebp
push 0x458f5d
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 8], eax
cmp ebx, 0xffffffff
jne 0x458e95
mov eax, dword [ebp - 4]
cmp byte [eax + 8], 0
je 0x458e95
lea eax, [ebp - 8]
push eax
push 0x4004667f
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.wsock32.dll_ioctlsocket
jmp 0x458f47
mov eax, dword [ebp - 4]
cmp byte [eax + 8], 0
jne 0x458ea8
call fcn.00403fc0
jmp 0x458f64
push 0
push ebx
push esi
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.wsock32.dll_recv
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
jne 0x458f47
call sub.wsock32.dll_WSAGetLastError
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0x2733
je 0x458f47
lea eax, [ebp - 0xc]
push eax
mov cl, 2
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 4]
mov si, 0xfffe
call fcn.00403944
mov eax, dword [ebp - 4]
mov edx, dword [eax + 4]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 8]
cmp dword [ebp - 0xc], 0
je 0x458f47
lea edx, [ebp - 0x28]
mov eax, dword [ebp - 0xc]
call fcn.0040be08
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0xb
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x1c], eax
mov byte [ebp - 0x18], 0
mov eax, 0x458f94
mov dword [ebp - 0x14], eax
mov byte [ebp - 0x10], 0xb
lea eax, [ebp - 0x24]
push eax
push 2
mov ecx, dword [0x4690a8]
mov dl, 1
mov eax, dword [0x45781c]
call fcn.0040c754
call fcn.00403f14
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x458f64
mov eax, dword [ebp - 4]
call fcn.00458464
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x458f81
lea eax, [ebp - 0x28]
call fcn.00404558
ret

Function at 0x45bc44
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov edi, edx
mov ebx, eax
mov al, byte [ebp + 8]
call fcn.0045b8a8
mov esi, eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
push esi
push 0
mov eax, edi
call fcn.00404a08
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegSetValueExA
test eax, eax
je 0x45bca2
mov dword [ebp - 0xc], edi
mov byte [ebp - 8], 0xb
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, dword [0x468fc0]
mov dl, 1
mov eax, dword [0x45b7a0]
call fcn.0040c754
call fcn.00403f14
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x45bcac
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp + 0xc]
push eax
push edi
lea eax, [ebp - 4]
push eax
push 0
mov eax, esi
call fcn.00404a08
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
je 0x45bd04
mov dword [ebp - 0xc], esi
mov byte [ebp - 8], 0xb
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, dword [0x46919c]
mov dl, 1
mov eax, dword [0x45b7a0]
call fcn.0040c754
call fcn.00403f14
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
call fcn.0045b8d8
mov edx, dword [ebp + 8]
mov byte [edx], al
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x45d738
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebx
push esi
push edi
add esp, 0xffffffec
mov esi, edx
lea edi, [esp + 8]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov ebx, dword [esp + 8]
test ebx, ebx
je 0x45d794
push esp
push 0x40
push 6
push ebx
call sub.kernel32.dll_VirtualProtect
test eax, eax
jne 0x45d763
call fcn.0040d97c
mov edx, dword [esp + 8]
lea eax, [esp + 0xc]
mov ecx, 6
call fcn.00402900
lea eax, [esp + 4]
push eax
mov eax, dword [esp + 4]
push eax
push 6
mov eax, dword [esp + 0x14]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
jne 0x45d794
call fcn.0040d97c
add esp, 0x14
pop edi
pop esi
pop ebx
ret
Function at 0x45de88
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffed8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x124], ecx
mov dword [ebp - 0x128], ecx
mov dword [ebp - 0x120], ecx
mov dword [ebp - 0x11c], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004049f8
xor eax, eax
push ebp
push 0x45e0db
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
call fcn.00404558
xor eax, eax
push ebp
push 0x45dfc6
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 0x29
mov eax, dword [ebp - 4]
mov edx, 0x45e0f4
call fcn.00404954
jne 0x45df15
cmp byte [0x46ae98], 0
je 0x45df0b
mov dword [ebp - 0xc], 0x28
jmp 0x45dfbc
xor eax, eax
mov dword [ebp - 0xc], eax
jmp 0x45dfbc
mov eax, dword [ebp - 4]
mov edx, 0x45e118
call fcn.00404954
jne 0x45df30
mov dword [ebp - 0xc], 0x15
jmp 0x45dfbc
mov eax, dword [ebp - 4]
mov edx, 0x45e12c
call fcn.00404954
jne 0x45df48
mov dword [ebp - 0xc], 0x29
jmp 0x45dfbc
mov eax, dword [ebp - 4]
mov edx, 0x45e140
call fcn.00404954
jne 0x45df60
mov dword [ebp - 0xc], 0x26
jmp 0x45dfbc
mov eax, dword [ebp - 4]
mov edx, 0x45e158
call fcn.00404954
jne 0x45df78
mov dword [ebp - 0xc], 0x27
jmp 0x45dfbc
mov eax, dword [ebp - 4]
mov edx, 0x45e170
call fcn.00404954
jne 0x45df90
mov dword [ebp - 0xc], 0x27
jmp 0x45dfbc
mov eax, dword [ebp - 4]
mov edx, 0x45e184
call fcn.00404954
jne 0x45dfa6
xor eax, eax
mov dword [ebp - 0xc], eax
jmp 0x45dfbc
mov eax, dword [ebp - 4]
mov edx, 0x45e19c
call fcn.00404954
jne 0x45dfbc
mov dword [ebp - 0xc], 0x19
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x45dfd0
xor edx, edx
push ebp
push 0x45e09b
push dword fs:[edx]
mov dword fs:[edx], esp
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 0xc]
push eax
push 0
call sub.shell32.dll_SHGetSpecialFolderLocation
test eax, eax
jne 0x45e091
lea eax, [ebp - 0x115]
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.shell32.dll_SHGetPathFromIDListA
test eax, eax
je 0x45e091
lea eax, [ebp - 0x11c]
lea edx, [ebp - 0x115]
mov ecx, 0x105
call fcn.004047c0
mov edx, dword [ebp - 0x11c]
mov eax, dword [ebp - 8]
xor ecx, ecx
call fcn.0040485c
mov eax, dword [ebp - 4]
mov edx, 0x45e158
call fcn.00404954
jne 0x45e062
lea edx, [ebp - 0x120]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
call fcn.00408ef0
mov edx, dword [ebp - 0x120]
mov eax, dword [ebp - 8]
call fcn.004045ac
jmp 0x45e091
lea eax, [ebp - 0x128]
mov edx, dword [ebp - 8]
mov edx, dword [edx]
call fcn.00404dc4
mov eax, dword [ebp - 0x128]
lea edx, [ebp - 0x124]
call fcn.0045db20
mov edx, dword [ebp - 0x124]
mov eax, dword [ebp - 8]
call fcn.004047d8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x45e0a5
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45e0e2
lea eax, [ebp - 0x128]
mov edx, 2
call fcn.00404c60
lea eax, [ebp - 0x120]
mov edx, 2
call fcn.0040457c
lea eax, [ebp - 4]
call fcn.00404558
ret
Function at 0x45e244
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov esi, eax
xor eax, eax
push ebp
push 0x45e344
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x45e302
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, 0xff
call fcn.00402748
mov ebx, eax
push 0xff
push ebx
push 0x45e354
call sub.kernel32.dll_GetEnvironmentVariableA
test eax, eax
jne 0x45e2c7
lea eax, [ebp - 0xc]
call fcn.0045e1ac
mov edx, dword [ebp - 0xc]
lea eax, [ebp - 8]
call fcn.00404dc4
mov eax, dword [ebp - 8]
lea edx, [ebp - 4]
call fcn.0045db20
lea eax, [ebp - 4]
mov edx, 0x45e360
call fcn.00404e5c
mov edx, dword [ebp - 4]
mov eax, esi
call fcn.004047d8
jmp 0x45e2f1
lea eax, [ebp - 0x18]
mov edx, ebx
call fcn.00404748
mov edx, dword [ebp - 0x18]
lea eax, [ebp - 0x14]
call fcn.00404dc4
mov eax, dword [ebp - 0x14]
lea edx, [ebp - 0x10]
call fcn.0045db20
mov edx, dword [ebp - 0x10]
mov eax, esi
call fcn.004047d8
mov eax, ebx
call fcn.00402768
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x45e30c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45e34b
lea eax, [ebp - 0x18]
call fcn.00404558
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.00404c60
lea eax, [ebp - 0xc]
call fcn.00404558
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404c60
ret

Function at 0x45e590
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
push ebp
push 0x45e611
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x469034]
mov eax, dword [eax]
call fcn.00455f20
test ebx, ebx
jg 0x45e5c0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x45e61b
call sub.kernel32.dll_GetTickCount
mov esi, eax
push 1
call sub.kernel32.dll_Sleep
mov eax, dword [0x469034]
mov eax, dword [eax]
call fcn.00455f20
call sub.kernel32.dll_GetTickCount
xor edx, edx
push edx
push eax
mov eax, esi
cdq
sub dword [esp], eax
sbb dword [esp + 4], edx
pop eax
pop edx
push edx
push eax
mov eax, ebx
cdq
cmp edx, dword [esp + 4]
jne 0x45e603
cmp eax, dword [esp]
pop edx
pop eax
ja 0x45e5c7
jmp 0x45e607
pop edx
pop eax
jg 0x45e5c7
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x45e61b
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x461554
Capabilities:
Download url
Receive data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x118], ebx
mov dword [ebp - 0xc], ebx
mov ebx, ecx
mov dword [ebp - 4], edx
mov esi, eax
mov eax, dword [ebp - 4]
call fcn.004049f8
xor eax, eax
push ebp
push 0x46169a
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 1
xor eax, eax
push ebp
push 0x461667
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00461198
test al, al
je 0x4615c7
lea edx, [ebp - 0x118]
mov eax, dword [esi + 0xc]
call fcn.00461488
mov ecx, dword [ebp - 0x118]
lea eax, [ebp - 0xc]
mov edx, dword [ebp - 4]
call fcn.0040485c
jmp 0x4615d2
lea eax, [ebp - 0xc]
mov edx, dword [ebp - 4]
call fcn.004045f0
mov byte [esi + 0x10], 0
mov eax, dword [esi + 0xc]
call fcn.00404a08
push eax
call sub.wininet.dll_DeleteUrlCacheEntry
test bl, bl
je 0x461612
mov eax, esi
test eax, eax
je 0x4615f1
sub eax, 0xffffffc0
push eax
push 0
push 0x104
lea eax, [ebp - 0x111]
push eax
mov eax, dword [esi + 0xc]
call fcn.00404a08
push eax
push 0
call sub.URLMON.DLL_URLDownloadToCacheFileA
jmp 0x461642
mov eax, esi
test eax, eax
je 0x46161b
sub eax, 0xffffffc0
push eax
push 0
mov eax, dword [ebp - 0xc]
call fcn.00404a08
push eax
mov eax, dword [esi + 0xc]
call fcn.00404a08
push eax
push 0
call sub.URLMON.DLL_URLDownloadToFileA
lea eax, [esi + 0x30]
mov edx, dword [ebp - 0xc]
call fcn.004045ac
cmp byte [esi + 0x10], 0
jne 0x461654
cmp dword [esi + 0x34], 0
jne 0x461654
cmp byte [esi + 0x38], 0
jne 0x461658
xor eax, eax
jmp 0x46165a
mov al, 1
mov byte [ebp - 5], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x461671
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4616a1
lea eax, [ebp - 0x118]
call fcn.00404558
lea eax, [ebp - 0xc]
call fcn.00404558
lea eax, [ebp - 4]
call fcn.00404558
ret

Function at 0x4f4b51
Capabilities:
Parse pe header

Disassembly:
pushal
jmp 0x4f4910
jmp 0x4f4653
call 0x4f4659
int1
xchg dword [esp], edi
lea edi, [edi - 0x196]
xchg dword [esp], edi
jmp 0x4f44c2
push esp
jmp 0x4f4b4b
xor eax, eax
jmp 0x4f45b0
call 0x4f4b51
ja 0x92dc6f6a
invalid
lea eax, [eax + eax*8 + 0x1040100]
jmp 0x4f4989
Function at 0x10107f87
Capabilities:
Decompress data using aplib

Disassembly:
push ebp
mov ebp, esp
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
cld
mov dl, 0x80
movsb byte es:[edi], byte [esi]
call fcn.10108006
jae 0x10107f93
xor ecx, ecx
call fcn.10108006
jae 0x10107fbd
xor eax, eax
call fcn.10108006
jae 0x10107fce
mov al, 0x10
call fcn.10108006
adc al, al
jae 0x10107faf
jne 0x10107ffb
stosb byte es:[edi], al
jmp 0x10107f94
call fcn.10108012
dec ecx
loop 0x10107fda
mov eax, ebp
call fcn.10108010
jmp 0x10107ffc
lodsb al, byte [esi]
shr eax, 1
je 0x10108022
adc ecx, 2
mov ebp, eax
jmp 0x10107ffc
xchg ecx, eax
dec eax
shl eax, 8
lodsb al, byte [esi]
mov ebp, eax
call fcn.10108010
cmp eax, 0x7d00
jae 0x10107ffa
cmp eax, 0x500
jae 0x10107ffb
cmp eax, 0x7f
ja 0x10107ffc
inc ecx
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x10107f94
pop ebp
ret 8
Function at 0x404a80
Capabilities:
Hash data with crc32

Disassembly:
push esi
mov esi, dword [fcn.0040408c]
push edi
push 0x10000
push 2
call esi
mov edi, dword [fcn.004040c8]
push eax
mov dword [0x405434], eax
call edi
push 0x8040
push 2
mov dword [0x405430], eax
call esi
push eax
mov dword [0x40546c], eax
call edi
push 0x400
push 2
mov dword [0x40545c], eax
call esi
push eax
mov dword [0x40544c], eax
call edi
mov dword [0x405438], eax
and dword [eax], 0
push 1
pop eax
pop edi
pop esi
push 8
mov ecx, eax
pop edx
test cl, 1
je 0x404aec
shr ecx, 1
xor ecx, 0xedb88320
jmp 0x404aee
shr ecx, 1
dec edx
jne 0x404add
mov edx, dword [0x405438]
mov dword [edx + eax*4], ecx
inc eax
cmp eax, 0x100
jl 0x404ad8
ret

Function at 0x405b20
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [esp + 4]
test ecx, ecx
jne 0x405b32
or eax, 0xffffffff
mov dword [0x405000], eax
jmp 0x405b6b
mov edx, dword [esp + 8]
mov eax, dword [0x405000]
push esi
mov esi, edx
dec edx
test esi, esi
je 0x405b65
push edi
inc edx
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
mov edi, dword [0x405438]
shr eax, 8
mov esi, dword [edi + esi*4]
xor eax, esi
inc ecx
dec edx
jne 0x405b45
pop edi
mov dword [0x405000], eax
pop esi
not eax
ret 8
Function at 0x401750
Capabilities:
Terminate process

Disassembly:
adc al, 0x11
inc eax
div edi
adc byte [0x40121a08], ah
add byte [0x8c004012], bh
adc dword [eax], eax
sub dword [eax + eax*2 + 0x40147600], ecx
add byte [ebp - 0x20a2bfec], al
mov ch, 0x40
add bl, dh
adc al, 0x40
add dh, ah
adc eax, 0x1b000040
add dword [ebx], ebx
sbb eax, esi
sbb eax, dword [edx]
sbb ebx, dword [ebx]
sbb ebx, dword [ebx]
sbb esp, dword [ebp + 0x1b7a031b]
sbb eax, 0x1b0c7405
pop es
xor ebx, dword [ebx]
sbb ecx, dword [esi]
sbb ebx, dword [ebx]
sbb dword [ebx], 0xa09081b
retf
or al, 0xb4
push cs
sbb ecx, dword [edi]
int1
outsd dx, dword [esi]
adc byte [ebx], bl
adc dword [edx], edx
adc ecx, dword [eax + 0x17ec1514]
popfd
sbb dword [edx], ebx
nop
nop
nop
nop
in al, dx
nop
nop
nop
js 0x4016dc
nop
nop
nop
nop
push ebp
mov ebp, esp
mov edx, dword [edx + 8]
mov ebp, dword [ebp + sym.imp.MSVCRT.dll__iob]
push eax
xor ecx, 0x40
push 0xd540d274
push ecx
call dword [0x5faec180]
jp 0x40171a
add al, byte [ecx]
add esp, 2
test dword [ecx + 0x68500f74], esi
push esp
rol byte [eax], cl
call dword [0x403564]
add esp, 0xffffffaf
push 1
call dword [sym.imp.MSVCRT.dll_exit]
nop
push ebp
cmpsb byte [esi], byte es:[edi]
jge 0x40172e

Function at 0x405400
Capabilities:
Encode data using xor

Disassembly:
outsb dx, byte [esi]
add al, dh
invalid
add dword [eax + eax + 0x20003d], ebx
add byte [ebx + 0xa], dh
mov dword [ebp - 4], 0x2000
mov eax, dword [ebp - 4]
mov esi, esi
rcl dword [ebp + 0xc], 0x4f
cmp edi, 0xffffffff
mov dword [ebp - 8], edi
ja 0x4055c0
push es
ja 0x407315
mov eax, dword [esi + 0xc]
jo 0x4053f3
inc ebp
push es
push eax
call fcn.0040a2d0
add byte [eax], al
cmp dword [esi + edi*4 + 0x14], 0xffffffaa
mov ecx, dword [esi]
pop eax
inc esp
mov esi, 0x89d78b14
push ebp
clc
jne 0x405439
cmp edx, dword [esi - 0x3f7cf68d]
add al, 0x42
cmp dword [eax], 0
hlt
pop edi
pop esi
xor ebp, 0xffffffff
pop ebx
mov edx, ebp
pop ebp
ret
mov ebp, eax
stosb byte es:[edi], al
add al, 0x50
and eax, 0x3c
cmp al, 0xf0
je 0x407346
movsx edx, byte [edi]
invalid
mov dword [ebp + 0x10], edi
push 3
push str.I64d
push edi
xchg edx, eax
adc eax, sym.imp.MSVCRT.dll_strncmp
les ecx, fs:[esp]
add esi, dword [edi + esi - 0x76]
pop es
cmp al, 0x71
jne 0x407376
xor eax, eax
inc edi
jmp 0x40739a
cmp al, 0x6c
push ebp
arpl word [eax + 0x7501], di
fucompi st(3)
je 0x4073bf
push 0x2400875
add byte [eax], al
add byte [edi - 0x5b], al
cmp bh, byte [eax - 0x52fffffd]
jmp 0x40739d
mov dword [ebp + 0x10], edx
mov edx, dword [ebp + 0x10]
sbb cl, byte [edx]
movsx edi, cl
stc
cmp edi, 0x78
or al, 0x87
fnstsw word [esi]
add byte [eax], al
xor edx, edx
mov bh, byte [edi]
add al, 0x7c
and byte [eax], al
jmp dword [edx*4 + 0x407bd0]
sub byte [edx], ah
mov ecx, dword [ebx + 4]
rcl byte [ebp - 0x16]
jno 0x40735b
push edx
xor byte [esi], 0xac
mov eax, ebx
or byte [edx + 0x65], dl
push ebp
shl byte [eax + 0x6a], 1
aam 0x51
dec esi
call 0x78408150
pop ds
les ebx, [eax]
jmp 0x407417
mov esi, eax
mov eax, dword [ebp - 0x1c]
test eax, eax
jno 0x4073a4
mov ebx, 0x8b0000b0
inc ebp
invalid
mov ebx, esp
mov ecx, dword [edx + 0xfc03d02]
test dword [ebp + esi*8 - 1], ebx
dec dword [ebx + 0x453a0cb7]
hlt
Function at 0x40af1c
Capabilities:
Encode data using xor

Disassembly:
call 0x40ae2f
mov ecx, 0x1fc
call 0x40af1c
rcr dword [esi + 0x30], 0x4c
push cs
pop es
xor byte [esi + ecx + 7], cl
loop 0x40af1f
mov ecx, 0x4685b453
invalid
Function at 0x733b10
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x2df000]
push edi
jmp 0x733b2a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x733b31
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x733b20
mov eax, 1
add ebx, ebx
jne 0x733b43
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x733b54
jne 0x733b73
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x733b73
dec eax
add ebx, ebx
jne 0x733b60
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x733b38
add ebx, ebx
jne 0x733b6f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x733bc5
xor ecx, ecx
sub eax, 3
jb 0x733b8b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x733bfa
sar eax, 1
mov ebp, eax
jmp 0x733b96
add ebx, ebx
jne 0x733b96
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x733b64
inc ecx
add ebx, ebx
jne 0x733ba4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x733b64
add ebx, ebx
jne 0x733bb1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x733ba6
jne 0x733bc2
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x733ba6
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x733be4
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x733bd6
jmp 0x733b26
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x733be4
add edi, ecx
jmp 0x733b26
pop esi
mov edi, esi
mov ecx, 0x3ed9
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x733c02
cmp byte [edi], 0x11
jne 0x733c02
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x733c07
lea edi, [esi + 0x32c000]
mov eax, dword [edi]
or eax, eax
je 0x733c7f
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x590b18]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x590c94]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x733c34
mov ecx, edi
jns 0x733c63
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x590c98]
or eax, eax
je 0x733c79
mov dword [ebx], eax
add ebx, 4
jmp 0x733c51
call dword [esi + 0x590ca8]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x733cb0
cmp al, 0xef
ja 0x733ca3
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x733c85
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x733c92
mov ebp, dword [esi + 0x590c9c]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x227]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x733ce4
sub esp, 0xffffff80
jmp 0x425f74
Function at 0x401ee2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x411280]
jne 0x401eec
repz ret
jmp fcn.00404369

Function at 0x4025e7
Capabilities:
Accept command line arguments
Parse pe header

Disassembly:
push 0x14
push 0x40f530
call fcn.00403770
mov eax, 0x5a4d
cmp word [0x400000], ax
jne 0x4024e7
mov eax, dword [0x40003c]
cmp dword [eax + 0x400000], 0x4550
jne 0x4024e7
mov ecx, 0x10b
cmp word [eax + 0x400018], cx
jne 0x4024e7
cmp dword [eax + 0x400074], 0xe
jbe 0x4024e7
xor ecx, ecx
cmp dword [eax + 0x4000e8], ecx
setne cl
mov dword [ebp - 0x1c], ecx
jmp 0x4024eb
and dword [ebp - 0x1c], 0
push 1
call fcn.00408afe
pop ecx
test eax, eax
jne 0x4024ff
push 0x1c
call fcn.00408afe
pop ecx
call fcn.00405287
test eax, eax
jne 0x402510
push 0x10
call fcn.00408afe
pop ecx
call fcn.00405952
and dword [ebp - 4], 0
call fcn.004032ff
test eax, eax
jge 0x40252a
push 0x1b
call fcn.00408afe
pop ecx
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov dword [0x412ba0], eax
call fcn.00408afe
mov dword [0x41203c], eax
call fcn.00408afe
test eax, eax
jge 0x402550
push 8
call fcn.00408afe
pop ecx
call fcn.00405fde
test eax, eax
jge 0x402561
push 9
call fcn.00408afe
pop ecx
push 1
call fcn.00408afe
pop ecx
test eax, eax
je 0x402574
push eax
call fcn.00408afe
pop ecx
mov eax, dword [0x412018]
mov dword [0x41201c], eax
push eax
push dword [0x412010]
push dword [0x41200c]
call main
add esp, 0xc
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x1c], 0
jne 0x4025a2
push eax
call fcn.00408afe
call fcn.00402400
jmp 0x4025d7
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [ebp - 0x20]
call fcn.004037b5
ret
call fcn.00408afe
jmp 0x402495

Function at 0x408afe
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
pushal
call 0x408b0d
pop dword [ebp - 0x10]
mov eax, 0xa5494fc2
add eax, 0x5af73b4b
sub dword [ebp - 0x10], eax
push 0x40
push 0x1000
push 0x3b4b0
push 0
mov eax, 0x20b2452c
add eax, 0xdf8e9bac
add eax, dword [ebp - 0x10]
call dword [eax]
mov ecx, 0x505e
xor edi, edi
add edi, eax
mov esi, 0xfcd89e6f
add esi, 0x3689d55
add esi, dword [ebp - 0x10]
mov ebx, 0x8194a4d9
add ebx, 0xc947a107
xor dword [ebp - 0xc], 0xf420b21f
mov edx, dword [esi]
xor dword [ebp - 0xc], 0xa02edf7b
sub edx, ebx
mov dword [edi], edx
sub dword [ebp - 0xc], ecx
add edi, 0x299641bf
add edi, 0xd669be45
add esi, 4
loop 0x408b68
add eax, 0x89643679
sub eax, 0x8963022e
mov ebx, eax
add eax, 0xd4c780ff
add eax, 0x2b387f06
mov ecx, 0x811b549e
add ecx, 0x7f24ab62
add ecx, dword [ebp - 0x10]
call ebx
leave
ret