joyce8/EMBER2024-capa huggingface dataset:
Function at 0x461080
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 0x10]
push ebx
push esi
push edi
mov cl, byte [eax + 0x100]
mov dl, byte [eax + 0x101]
mov dword [ebp - 8], eax
mov byte [ebp - 1], cl
mov byte [ebp - 2], dl
xor ebx, ebx
mov bl, byte [ebp - 1]
xor edx, edx
mov dl, byte [ebp - 2]
mov esi, dword [ebp - 8]
mov edi, dword [ebp + 8]
xor eax, eax
mov ecx, dword [ebp + 0xc]
test ecx, ecx
jle 0x4610d3
inc bl
mov al, byte [esi + ebx]
add dl, al
xchg byte [esi + edx], al
mov byte [esi + ebx], al
add al, byte [esi + edx]
mov al, byte [esi + eax]
xor byte [edi], al
inc edi
dec ecx
jne 0x4610ba
mov byte [ebp - 1], bl
mov byte [ebp - 2], dl
mov eax, dword [ebp + 0x10]
mov cl, byte [ebp - 1]
mov dl, byte [ebp - 2]
pop edi
pop esi
mov byte [eax + 0x100], cl
mov byte [eax + 0x101], dl
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x467a80
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x49462e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [esp + 0x18]
push esi
push edi
mov edi, ecx
mov ecx, dword [esp + 0x1c]
push eax
push ecx
mov ecx, edi
mov dword [esp + 0x10], edi
call fcn.004683a0
push 0x10
mov dword [esp + 0x18], 0
mov dword [edi], 0x49c994
call fcn.004864b2
mov esi, eax
add esp, 4
mov dword [esp + 0x20], esi
mov al, 1
test esi, esi
mov byte [esp + 0x14], al
je 0x467b13
push 4
mov byte [esi + 8], al
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.004864b2
add esp, 4
mov dword [esp + 0x1c], eax
test eax, eax
mov byte [esp + 0x14], 2
je 0x467b0c
push 0
mov ecx, eax
call fcn.0045ec00
mov dword [esi + 0xc], eax
jmp 0x467b15
xor eax, eax
mov dword [esi + 0xc], eax
jmp 0x467b15
xor esi, esi
mov ecx, dword [esp + 0xc]
mov dword [edi + 0x30], esi
mov dword [edi + 0x34], 0
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 8

Function at 0x488b18
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x488b50
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.00486bcc
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.00486ba4
jmp 0x488b5c
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x48a20b
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x48a24d
call fcn.0048fcbf
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x48a24d
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x48a244
xor eax, eax
jmp 0x48a255
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.0048a25b
pop edi
pop esi
pop ebx
ret 4
Function at 0x4901ef
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x49021d
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x49023b
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.00490155
jmp 0x49023b
mov eax, dword [esi + 0x14]
test eax, eax
je 0x49023b
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.00490155
test edi, edi
mov eax, edi
jne 0x490225
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8

Function at 0x4659a0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, 0x457015
lea edi, [esi - 0x56015]
push edi
or ebp, 0xffffffff
jmp 0x4659c2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x4659c9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4659b8
mov eax, 1
add ebx, ebx
jne 0x4659db
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x4659d0
jne 0x4659ec
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4659d0
xor ecx, ecx
sub eax, 3
jb 0x465a00
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x465a72
mov ebp, eax
add ebx, ebx
jne 0x465a0b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x465a18
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x465a3c
inc ecx
add ebx, ebx
jne 0x465a28
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x465a1d
jne 0x465a39
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x465a1d
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x465a5c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x465a4d
jmp 0x4659be
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x465a5c
add edi, ecx
jmp 0x4659be
pop esi
mov edi, esi
mov ecx, 0x33e
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x465a7a
cmp byte [edi], 0
jne 0x465a7a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov eax, ebx
loop 0x465a7f
lea edi, [esi + 0x63000]
mov eax, dword [edi]
or eax, eax
je 0x465aee
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x651f0]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x65254]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x465aac
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x65258]
or eax, eax
je 0x465ae8
mov dword [ebx], eax
add ebx, 4
jmp 0x465ac9
call dword [esi + 0x6525c]
popal
jmp 0x40da18
Function at 0x41caf0
Capabilities:
Create directory
Get common file path
Get hostname

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x136c
call fcn.004110a0
cmp dword [0x501d8c], 0x37
jne 0x41cbe3
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CommConfigDialogA]
lea eax, [ebp - 0x924]
push eax
lea ecx, [ebp - 0x1248]
push ecx
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
push str.teliyemukososixu
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push 0
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea edx, [ebp - 0x1368]
push edx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetCPInfoExA]
push 0
push str.sexebigulihijowawekowazini
push 0
push str.Rid_wizowufelerowudasosupud_duposuhaxixamofoc
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CompareStringW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetProcessShutdownParameters]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
lea eax, [ebp - 0x920]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
push 0
push 0
push 0
lea ecx, [ebp - 0xa48]
push ecx
call dword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
push 0
push str.funanatitoxemopatu_wecelatiseta
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push str.Nosaruvalekilit_hohefeco_pevovefajabejib_mefenipa_woliyijanexuc
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateSemaphoreW]
push 0
lea edx, [ebp - 0x808]
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
push 0
push str.fezekopupikayocicizojisowa_zihebagaponaxo
push 0
push str.tumuxi_yonilihoredaxi_xeminutarikehigawowahuyahoxyfu_nuzuluzo
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CompareStringW]
mov dword [ebp - 4], 0
mov eax, dword [0x502488]
add dword [ebp - 4], eax
mov eax, 0x8c456
add dword [ebp - 4], eax
mov eax, dword [0x4ffdfc]
add eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
add ecx, dword [ebp + 8]
mov dl, byte [ecx]
mov byte [eax], dl
mov esp, ebp
pop ebp
ret 4
Function at 0x41d1c0
Capabilities:
Allocate thread local storage
Delete file
Get disk information
Manipulate console buffer
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc68
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
cmp dword [0x501d8c], 0x516
jne 0x41d265
push 0
push 0
call sub.KERNEL32.dll_Process32NextW
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll__hread]
push 0
push 0
call dword [sym.imp.KERNEL32.dll__lopen]
push 0
call dword [sym.imp.KERNEL32.dll_ExitThread]
mov edx, dword [ebp + 0xc]
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 0xc]
shr eax, 3
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], 0
jmp 0x41d286
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
cmp edx, dword [ebp - 0xc]
jae 0x41d323
cmp dword [0x501d8c], 0x29
jne 0x41d2a6
push str.Wilemegeyinabey
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, dword [ebp - 8]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
shl ecx, 1
mov dword [ebp - 0x10], ecx
cmp dword [0x501d8c], 0x1c
jne 0x41d30b
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
push 0
lea edx, [ebp - 0xc68]
push edx
push str.vikoserujofafuhazivovejijuwaxu_zinige
call dword [sym.imp.KERNEL32.dll_GetVolumeNameForVolumeMountPointW]
mov dword [ebp - 0x464], 0
xor eax, eax
mov dword [ebp - 0x460], eax
mov dword [ebp - 0x45c], eax
mov dword [ebp - 0x458], eax
mov dword [ebp - 0x454], eax
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 4]
lea ecx, [eax + edx*4]
push ecx
call fcn.0041cec0
jmp 0x41d27d
mov esp, ebp
pop ebp
ret 0xc
Function at 0x430001
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
call 0x43000c
nop
nop
pop eax
nop
nop
nop
nop
add eax, 0x403d6f
sub eax, 0x403d15
nop
nop
nop
nop
mov ebx, dword [eax]
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
nop
cmp ebx, ecx
jl 0x430030
nop
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x43001e
nop
nop
nop
nop
popal
nop
nop
jmp loc.00401219

Function at 0x43b636
Capabilities:
Encode data using xor

Disassembly:
mov ebx, 0x43b3c1
push 0x3cdfd736
pop eax
call fcn.0043b674
and esi, esi
add eax, 0xe05b1831
xor dword [edi], ebx
dec eax
add eax, esi
push 0x42305c58
pop esi
inc edi
sub esi, esi
cmp edi, ecx
jne fcn.0043b636
mov esi, eax
push 0x587dd7a7
pop eax
inc eax
ret
Function at 0x401020
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x2c
mov esi, dword [eax]
mov dword [ebp - 0x1c], eax
movzx eax, word [esi]
test ax, ax
je 0x4011e4
xor ecx, ecx
xor ebx, ebx
xor edi, edi
jmp 0x40105f
cmp ax, 0x5c
jne 0x4010c0
add ebx, 1
lea edx, [ecx + 1]
movzx eax, word [esi + edx*2]
test ax, ax
je 0x40107d
mov ecx, edx
cmp ax, 9
je 0x40106b
cmp ax, 0x20
jne 0x401048
test edi, edi
je 0x4010d0
lea edx, [ecx + 1]
xor ebx, ebx
movzx eax, word [esi + edx*2]
test ax, ax
jne 0x40105d
lea ecx, [ecx + ecx + 4]
mov dword [esp + 8], ecx
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
sub esp, 0xc
mov dword [ebp - 0x20], eax
test eax, eax
jne 0x4010e0
mov eax, dword [ebp - 0x20]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
cmp ax, 0x22
jne 0x40106f
and ebx, 1
jne 0x40106f
xor edi, 1
jmp 0x401051
lea ecx, [ecx + ecx + 2]
jmp 0x401081
mov eax, dword [ebp - 0x1c]
mov ecx, dword [eax]
movzx eax, word [ecx]
test ax, ax
je 0x4011ee
mov esi, dword [ebp - 0x20]
lea ebx, [ecx + 2]
xor edi, edi
xor edx, edx
jmp 0x401126
mov ecx, ebx
cmp ax, 0x5c
jne 0x401198
mov eax, 0x5c
add edi, 1
add esi, 2
mov word [esi - 2], ax
movzx eax, word [ebx]
add ebx, 2
test ax, ax
je 0x40114f
cmp ax, 9
je 0x401132
cmp ax, 0x20
jne 0x401100
test edx, edx
je 0x4011dc
mov word [esi], ax
movzx eax, word [ebx]
mov ecx, ebx
add esi, 2
xor edi, edi
add ebx, 2
test ax, ax
jne 0x401126
xor eax, eax
mov word [esi], ax
mov eax, dword [ebp - 0x1c]
mov dword [eax], ecx
movzx eax, word [ecx]
cmp ax, 0x20
je 0x40116c
cmp ax, 9
jne 0x4010ac
add ecx, 2
nop
mov eax, dword [ebp - 0x1c]
mov dword [eax], ecx
movzx eax, word [ecx]
add ecx, 2
cmp ax, 9
je 0x401170
cmp ax, 0x20
je 0x401170
mov eax, dword [ebp - 0x20]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
cmp ax, 0x22
jne 0x40113a
mov eax, edi
shr eax, 0x1f
add eax, edi
sar eax, 1
and edi, 1
jne 0x4011c0
add eax, eax
xor edx, 1
xor edi, edi
sub esi, eax
jmp 0x40111b
mov edi, 0x7fffffff
sub edi, eax
lea eax, [esi + edi*2]
mov edi, 0x22
mov word [eax], di
lea esi, [eax + 2]
xor edi, edi
jmp 0x40111b
lea ecx, [ebx - 2]
jmp 0x40114f
mov ecx, 2
jmp 0x401081
mov esi, dword [ebp - 0x20]
jmp 0x40114f
Function at 0x402ef0
Capabilities:
Accept command line arguments
Get process heap force flags
Terminate process

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
and esp, 0xfffffff0
sub esp, 0x10
mov dword [esp], 1
call sub.ucrtbase.dll__configure_wide_argv
call sub.ucrtbase.dll__initialize_wide_environment
call sub.ucrtbase.dll___p___argc
mov esi, dword [eax]
call sub.ucrtbase.dll___p___wargv
mov edi, dword [eax]
call sub.ucrtbase.dll__get_initial_wide_environment
mov ebx, eax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 8]
mov edx, dword [eax + 0x3c]
cmp word [eax + edx + 0x5c], 2
sete al
movzx eax, al
add eax, 1
mov dword [esp], eax
call sub.ucrtbase.dll__set_app_type
mov dword [esp + 8], ebx
mov dword [esp + 4], edi
mov dword [esp], esi
call 0x402f60
mov dword [esp], eax
call sub.ucrtbase.dll_exit
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push esi
push ebx
push ecx
sub esp, 0x6c
call dword [sym.imp.kernel32.dll_GetCommandLineW]
mov ebx, eax
movzx eax, word [eax]
test ax, ax
je 0x402fc7
xor ecx, ecx
xor edx, edx
jmp 0x402fa9
cmp ax, 0x5c
jne 0x403038
add edx, 1
movzx eax, word [ebx + 2]
add ebx, 2
test ax, ax
je 0x402fc7
cmp ax, 9
je 0x402fb5
cmp ax, 0x20
jne 0x402f90
test ecx, ecx
je 0x403023
movzx eax, word [ebx + 2]
add ebx, 2
xor edx, edx
test ax, ax
jne 0x402fa9
lea eax, [ebp - 0x5c]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_GetStartupInfoW]
sub esp, 4
test byte [ebp - 0x30], 1
je 0x403058
movzx esi, word [ebp - 0x2c]
mov dword [esp], 0
call dword [sym.imp.kernel32.dll_GetModuleHandleW]
sub esp, 4
mov dword [esp + 0xc], esi
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov dword [esp], eax
call fcn.00401520
sub esp, 0x10
lea esp, [ebp - 0xc]
pop ecx
pop ebx
pop esi
pop ebp
lea esp, [ecx - 4]
ret
add ebx, 2
movzx eax, word [ebx]
cmp ax, 9
je 0x403020
cmp ax, 0x20
je 0x403020
jmp 0x402fc7
cmp ax, 0x22
jne 0x402fb9
and edx, 1
jne 0x402fb9
xor ecx, 1
jmp 0x402f9d
mov eax, 1
mov esi, 1
mov word [ebp - 0x2c], ax
jmp 0x402fe0
Function at 0x402f60
Capabilities:
Accept command line arguments
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
and esp, 0xfffffff0
sub esp, 0x10
mov dword [esp], 1
call sub.ucrtbase.dll__configure_wide_argv
call sub.ucrtbase.dll__initialize_wide_environment
call sub.ucrtbase.dll___p___argc
mov esi, dword [eax]
call sub.ucrtbase.dll___p___wargv
mov edi, dword [eax]
call sub.ucrtbase.dll__get_initial_wide_environment
mov ebx, eax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 8]
mov edx, dword [eax + 0x3c]
cmp word [eax + edx + 0x5c], 2
sete al
movzx eax, al
add eax, 1
mov dword [esp], eax
call sub.ucrtbase.dll__set_app_type
mov dword [esp + 8], ebx
mov dword [esp + 4], edi
mov dword [esp], esi
call 0x402f60
mov dword [esp], eax
call sub.ucrtbase.dll_exit
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push esi
push ebx
push ecx
sub esp, 0x6c
call dword [sym.imp.kernel32.dll_GetCommandLineW]
mov ebx, eax
movzx eax, word [eax]
test ax, ax
je 0x402fc7
xor ecx, ecx
xor edx, edx
jmp 0x402fa9
cmp ax, 0x5c
jne 0x403038
add edx, 1
movzx eax, word [ebx + 2]
add ebx, 2
test ax, ax
je 0x402fc7
cmp ax, 9
je 0x402fb5
cmp ax, 0x20
jne 0x402f90
test ecx, ecx
je 0x403023
movzx eax, word [ebx + 2]
add ebx, 2
xor edx, edx
test ax, ax
jne 0x402fa9
lea eax, [ebp - 0x5c]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_GetStartupInfoW]
sub esp, 4
test byte [ebp - 0x30], 1
je 0x403058
movzx esi, word [ebp - 0x2c]
mov dword [esp], 0
call dword [sym.imp.kernel32.dll_GetModuleHandleW]
sub esp, 4
mov dword [esp + 0xc], esi
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov dword [esp], eax
call fcn.00401520
sub esp, 0x10
lea esp, [ebp - 0xc]
pop ecx
pop ebx
pop esi
pop ebp
lea esp, [ecx - 4]
ret
add ebx, 2
movzx eax, word [ebx]
cmp ax, 9
je 0x403020
cmp ax, 0x20
je 0x403020
jmp 0x402fc7
cmp ax, 0x22
jne 0x402fb9
and edx, 1
jne 0x402fb9
xor ecx, 1
jmp 0x402f9d
mov eax, 1
mov esi, 1
mov word [ebp - 0x2c], ax
jmp 0x402fe0
Function at 0x5087e0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x90000]
push edi
jmp 0x5087fa
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x508801
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x5087f0
mov eax, 1
add ebx, ebx
jne 0x508813
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x508824
jne 0x508843
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x508843
dec eax
add ebx, ebx
jne 0x508830
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x508808
add ebx, ebx
jne 0x50883f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x508895
xor ecx, ecx
sub eax, 3
jb 0x50885b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x5088ca
sar eax, 1
mov ebp, eax
jmp 0x508866
add ebx, ebx
jne 0x508866
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x508834
inc ecx
add ebx, ebx
jne 0x508874
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x508834
add ebx, ebx
jne 0x508881
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x508876
jne 0x508892
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x508876
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x5088b4
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x5088a6
jmp 0x5087f6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x5088b4
add edi, ecx
jmp 0x5087f6
pop esi
mov edi, esi
mov ecx, 0x3ea9
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x5088d2
cmp byte [edi], 0x11
jne 0x5088d2
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x5088d7
lea edi, [esi + 0x101000]
mov eax, dword [edi]
or eax, eax
je 0x50894f
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x109c74]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x109e18]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x508904
mov ecx, edi
jns 0x508933
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x109e20]
or eax, eax
je 0x508949
mov dword [ebx], eax
add ebx, 4
jmp 0x508921
call dword [esi + 0x109e1c]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x508980
cmp al, 0xef
ja 0x508973
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x508955
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x508962
mov ebp, dword [esi + 0x109e24]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x22f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x5089b4
sub esp, 0xffffff80
jmp 0x42800a
Function at 0x43b63d
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x43b3c1
sub esi, edi
add esi, 0x597f76f9
or esi, edi
call fcn.0043b67c
add edi, 1
add esi, 0xbdd1ca78
inc edi
xor dword [ecx], eax
sub esi, esi
sub edi, 0x9f04f348
inc ecx
and edi, edi
and edi, esi
cmp ecx, edx
jne fcn.0043b63d
and esi, edi
and esi, esi
ret
Function at 0x4029af
Capabilities:
Enumerate pe sections

Disassembly:
mov eax, dword [ecx + 0x3c]
add eax, ecx
movzx ecx, word [eax + 0x14]
lea ecx, [ecx + eax + 0x18]
movzx eax, word [eax + 6]
push esi
xor esi, esi
push edi
test eax, eax
jbe 0x4029e4
mov edx, dword [ecx + 0xc]
cmp dword [esp + 0xc], edx
jb 0x4029dc
mov edi, dword [ecx + 0x10]
add edi, edx
cmp dword [esp + 0xc], edi
jb 0x4029e9
inc esi
add ecx, 0x28
cmp esi, eax
jb 0x4029c8
xor eax, eax
pop edi
pop esi
ret
mov eax, dword [ecx + 0x14]
sub eax, edx
add eax, dword [esp + 0xc]
jmp 0x4029e6

Function at 0x4029f4
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [edi + 0x3c]
add eax, edi
xor edx, edx
mov ecx, 0x8664
cmp word [eax + 4], cx
setne dl
dec edx
and edx, eax
mov ecx, edx
je 0x402a1a
mov eax, dword [ecx + 0x88]
jmp 0x402a1d
mov eax, dword [eax + 0x78]
push ebx
push esi
push eax
mov ecx, edi
call fcn.004029af
mov esi, eax
add esi, edi
push dword [esi + 0x20]
mov ecx, edi
call fcn.004029af
and dword [ebp - 4], 0
mov ebx, eax
pop ecx
add ebx, edi
cmp dword [esi + 0x18], 0
pop ecx
jbe 0x402a70
push dword [ebp + 8]
mov eax, dword [ebp - 4]
push dword [ebx + eax*4]
mov ecx, edi
call fcn.004029af
pop ecx
add eax, edi
push eax
call dword [0x100030f8]
pop ecx
pop ecx
test eax, eax
je 0x402a76
inc dword [ebp - 4]
mov eax, dword [ebp - 4]
cmp eax, dword [esi + 0x18]
jb 0x402a45
xor eax, eax
pop esi
pop ebx
leave
ret
push dword [esi + 0x24]
mov ecx, edi
call fcn.004029af
mov ecx, dword [ebp - 4]
push dword [esi + 0x1c]
add eax, edi
movzx ebx, word [eax + ecx*2]
mov ecx, edi
call fcn.004029af
pop ecx
add eax, edi
mov eax, dword [eax + ebx*4]
pop ecx
jmp 0x402a72