joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401d48
Capabilities:
Get common file path
Get hostname
Get session user name

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp - 4]
push esi
mov esi, 0x400
push eax
push 0x40dda8
mov dword [ebp - 4], esi
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
lea eax, [ebp - 4]
mov dword [ebp - 4], esi
push eax
push 0x40d988
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
push 0x40d584
push esi
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
push esi
mov esi, 0x40cd48
push esi
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push esi
mov esi, 0x40d184
push esi
call fcn.00402af0
push esi
call fcn.004029f0
add esp, 0xc
add eax, esi
cmp eax, esi
jb 0x401db4
cmp byte [eax], 0x5c
je 0x401db4
dec eax
jmp 0x401da8
inc eax
cmp eax, esi
pop esi
jb 0x401dbd
and byte [eax], 0
leave
ret

Function at 0x4070f9
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x40b228
cmp edx, dword [eax]
je 0x40711b
add eax, 8
inc ecx
cmp eax, 0x40b2b8
jl 0x40710c
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x40b228]
jne 0x407249
mov eax, dword [0x40e9c4]
cmp eax, 1
je 0x407223
test eax, eax
jne 0x40714c
cmp dword [0x40b154], 1
je 0x407223
cmp edx, 0xfc
je 0x407249
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x407183
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.00402af0
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.004029f0
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x4071c6
lea eax, [ebp - 0x1a4]
push eax
call fcn.004029f0
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x4095cc
push edi
call fcn.00408000
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.00402af0
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.00402b00
lea eax, [ebp - 0xa0]
push 0x4095ac
push eax
call fcn.00402b00
push dword [esi + 0x40b22c]
lea eax, [ebp - 0xa0]
push eax
call fcn.00402b00
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.00407f6e
add esp, 0x2c
pop edi
jmp 0x407249
lea eax, [ebp + 8]
lea esi, [esi + 0x40b22c]
push 0
push eax
push dword [esi]
call fcn.004029f0
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret

Function at 0x430006
Capabilities:
Encode data using xor

Disassembly:
mov eax, section..text
nop
nop
mov ebx, 0x408ecc
nop
mov ecx, 0x24db6cc9
nop
nop
test eax, eax
nop
nop
nop
je 0x43004e
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x430024
nop
nop
nop
nop
mov eax, section..data
nop
nop
mov ebx, 0x42e1d0
mov ecx, 0x8ba1c97
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x430084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x43006c
nop
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x401219
Function at 0x401000
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x53dd9c
push eax
push dword fs:[0]
push ebx
add byte [eax + 0x64], dl
push dword [0]
mov dword fs:[0], esp
xor eax, eax
mov dword [eax], ecx
push eax
inc ebp
inc ebx
outsd dx, dword [esi]
insd dword es:[edi], dx
jo 0x401080
arpl word [edx + esi], si
adc ebx, dword [edi - 0x54]
xchg ebx, eax
neg dl
push cs
dec ecx
mov eax, 0x7fb97088
add ah, ah
aam 0xe7
mov dword [0x98c0ec09], eax
mov eax, dword [0xf6a8b15c]
jecxz 0x401003
xor dword [ecx], ecx
iretd
ljmp 0x2bdb:0xc41a7522
jne 0x40109c
invalid
mov ch, byte [edx + 0x477bf67f]
jle 0x4010d4
salc
rcr cl, 1
cwde
add al, 0x60
sub byte [ecx + 0x485b75a6], bh
adc byte [eax], cl
xor eax, 0x4156615a
clc
or edi, dword [esi + 0x54]
xchg byte [ebx + 0x456a3141], bl
adc dword [edx + 0x30], ecx
jno 0x401110
sbb ebx, edi
cmp al, 0x6e
jae 0x40107e
out dx, al
aad 0x69
sub dword [edi + 0x33], ebx
retf
push ebp
mov cs, edx
mov bl, byte [edx + 0x3812e7a7]
adc eax, 0x31bdc80d
movsd dword es:[edi], dword [esi]
fild qword [eax]
add ch, al
cmpsd dword [esi], dword es:[edi]
dec eax
ret
Function at 0x524710
Capabilities:
Decompress data using aplib

Disassembly:
push ebp
mov ebp, esp
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
cld
mov dl, 0x80
movsb byte es:[edi], byte [esi]
call fcn.0052478f
jae 0x52471c
xor ecx, ecx
call fcn.0052478f
jae 0x524746
xor eax, eax
call fcn.0052478f
jae 0x524757
mov al, 0x10
call fcn.0052478f
adc al, al
jae 0x524738
jne 0x524784
stosb byte es:[edi], al
jmp 0x52471d
call fcn.0052479b
dec ecx
loop 0x524763
mov eax, ebp
call fcn.00524799
jmp 0x524785
lodsb al, byte [esi]
shr eax, 1
je 0x5247ab
adc ecx, 2
mov ebp, eax
jmp 0x524785
xchg ecx, eax
dec eax
shl eax, 8
lodsb al, byte [esi]
mov ebp, eax
call fcn.00524799
cmp eax, 0x7d00
jae 0x524783
cmp eax, 0x500
jae 0x524784
cmp eax, 0x7f
ja 0x524785
inc ecx
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x52471d
pop ebp
ret 8

Function at 0x57bdce
Capabilities:
Decompress data using aplib

Disassembly:
push ebp
mov ebp, esp
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
cld
mov dl, 0x80
movsb byte es:[edi], byte [esi]
call fcn.0057be4d
jae 0x57bdda
xor ecx, ecx
call fcn.0057be4d
jae 0x57be04
xor eax, eax
call fcn.0057be4d
jae 0x57be15
mov al, 0x10
call fcn.0057be4d
adc al, al
jae 0x57bdf6
jne 0x57be42
stosb byte es:[edi], al
jmp 0x57bddb
call fcn.0057be59
dec ecx
loop 0x57be21
mov eax, ebp
call fcn.0057be57
jmp 0x57be43
lodsb al, byte [esi]
shr eax, 1
je 0x57be69
adc ecx, 2
mov ebp, eax
jmp 0x57be43
xchg ecx, eax
dec eax
shl eax, 8
lodsb al, byte [esi]
mov ebp, eax
call fcn.0057be57
cmp eax, 0x7d00
jae 0x57be41
cmp eax, 0x500
jae 0x57be42
cmp eax, 0x7f
ja 0x57be43
inc ecx
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x57bddb
pop ebp
ret 8

Function at 0x5c7863
Capabilities:
Decompress data using aplib

Disassembly:
push ebp
mov ebp, esp
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
cld
mov dl, 0x80
movsb byte es:[edi], byte [esi]
call fcn.005c78e2
jae 0x5c786f
xor ecx, ecx
call fcn.005c78e2
jae 0x5c7899
xor eax, eax
call fcn.005c78e2
jae 0x5c78aa
mov al, 0x10
call fcn.005c78e2
adc al, al
jae 0x5c788b
jne 0x5c78d7
stosb byte es:[edi], al
jmp 0x5c7870
call fcn.005c78ee
dec ecx
loop 0x5c78b6
mov eax, ebp
call fcn.005c78ec
jmp 0x5c78d8
lodsb al, byte [esi]
shr eax, 1
je 0x5c78fe
adc ecx, 2
mov ebp, eax
jmp 0x5c78d8
xchg ecx, eax
dec eax
shl eax, 8
lodsb al, byte [esi]
mov ebp, eax
call fcn.005c78ec
cmp eax, 0x7d00
jae 0x5c78d6
cmp eax, 0x500
jae 0x5c78d7
cmp eax, 0x7f
ja 0x5c78d8
inc ecx
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x5c7870
pop ebp
ret 8
Function at 0x8742b2
Capabilities:
Execute anti-debugging instructions

Disassembly:
cpuid
push dword [esp + 0x12]
neg ebp
xchg ah, bh
pop eax
rdtsc
call fcn.00874123
lea edx, [esi - 0x6e512ac9]
sub esp, 0x10
lea esp, [esp + 7]
lea edi, [ebx*4]
mov ch, 0x27
rdtsc
jmp 0x874139
xchg esi, eax
std
mov al, 0x60
add esp, 0xb
jmp 0x874172

Function at 0x8742bf
Capabilities:
Execute anti-debugging instructions

Disassembly:
bsr ax, ax
jmp 0x8742c9
mov ax, cx
xchg dword [esp + 4], esi
mov cx, di
xchg byte [esp + 0x1a], ch
mov cl, 0x4f
mov ecx, dword [esp + 5]
jmp 0x874309
neg di
setb dl
lea esi, [0x2060fb5d]
mov esi, 0x8eff7e4a
cpuid
cpuid
jmp 0x8742f3
Function at 0x874576
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg word [esp], di
dec eax
push word [esp + 2]
xchg byte [esp + 3], cl
not edx
lea edx, [ecx*4]
jmp 0x87452b
mov esi, dword [esp + 3]
inc di
neg eax
cpuid
rdtsc
pop si
jmp 0x8744bf
pushfd
rdtsc
sub esp, 0xf
pop esi
pop word [esp + 2]
jmp 0x874555
xchg byte [esp + 3], al
xchg dword [esp], ebx
sub esp, 0xb
inc ah
sub esp, 0x12
pop ebp
jmp 0x8744f1
mov byte [esp + 3], dl
bswap esi
mov ah, dh
xchg dword [esp], edx
mov ax, 0x2c45
setp dh
jmp 0x874507
btc ecx, ebx
mov cx, word [esp + 0x13]
add bx, 0xa2
call fcn.00874593
insb byte es:[edi], dx
jg 0x87459a
int1
lea ecx, [ebp*4]
mov edi, ebp
xchg dword [esp + 0x25], eax
btr edi, edx
push word [esp + 9]
lea edx, [esi - 0x4e11]
jmp 0x87453f
dec cl
jmp 0x8744e1
mov ebp, 0x66dfebf9
push dword [esp + 9]
sub esp, 1
mov byte [esp + 8], al
mov si, 0x5b98
bswap ebp
xchg word [esp], bx
jmp 0x874a89
sbb ebp, edx
call fcn.00874630
pop edx
mov bh, byte [esp + 6]
cmc
lea edi, [ebp + ebp]
pushal
mov dx, sp
jmp 0x8749c3
sub esp, 0xf
lea esp, [esp + 0x25]
mov si, word [esp]
pop edi
jmp 0x8749a8
mov bh, dl
mov bl, ch
pop ebx
add esp, 0xf
mov dword [esp + 0x10], ecx
mov ebx, dword [esp + 7]
jmp 0x87496a
bsr bx, ax
lea esp, [esp]
mov dword [esp + 4], eax
or ebp, edi
rdtsc
jmp 0x8749ef
lea esi, [edi + 0xf8]
ror ah, cl
mov di, ax
push edx
lea ebp, [ebp - 0xd8]
jmp 0x874992
mov dword [esp + 0xb], eax
ror ax, cl
mov ah, 0x2f
lea ebx, [edi - 0x36]
xchg dword [esp + 0x2d], ecx
mov dword [esp + 0xc], edx
jmp 0x874980
xchg edi, ecx
mov al, byte [esp + 7]
add esp, 4
call fcn.008749d9
rol ax, 0xa
setg al
xchg byte [esp + 4], ah
pop ebx
mov word [esp + 1], sp
mov dh, byte [esp + 6]
jmp 0x874a48
mov bh, ah
mov ebp, dword [esp + 1]
xchg bx, cx
bts eax, esi
jmp 0x874a72
add ax, 0x4de1
lea esp, [esp + 6]
neg ebp
sub esp, 6
pop si
sub esp, 0xb
jmp 0x874a32
lea edx, [esp - 0x18]
push bp
xchg dword [esp], edx
mov ah, 0x93
pop cx
jmp 0x874c78
mov si, word [esp + 7]
rdtsc
bsr si, bp
add esp, 0xd
jmp 0x874a5c
rcl esi, cl
lea edx, [edi - 0x2e14a712]
lea esi, [ebp + 0x1aa3d23e]
mov ecx, dword [esp + 4]
pop dx
mov ax, word [esp + 8]
jmp 0x87491b
pop cx
call fcn.00874ad7
salc
inc edi
xlatb
mov dl, 0x41
out 0x6c, al
clc
outsb dx, byte [esi]
or eax, edi
dec esp
push ebp
les esi, [edi - 0x75]
je 0x874ae4
mov esi, dword [esp + 5]
mov byte [esp + 1], dl
add eax, 0x1245488
mov word [esp], si
xchg word [esp + 2], dx
mov edi, dword [esp + 1]
lea esi, [esp + edi]
jmp 0x874aa7
hlt
bsf ax, cx
mov dh, ch
push word [esp + 0x17]
not dx
push word [esp + 0x20]
lea esp, [esp + 0x21]
jmp 0x874abd
xchg dh, bh
xchg word [esp], bx
lea ebx, [edx*4]
lea edx, [eax + edi]
pushal
mov word [esp + 6], bx
jmp 0x874af8
push word [esp + 2]
add esp, 2
mov byte [esp + 1], cl
mov bx, bp
mov esi, ecx
bt esi, esp
jmp 0x874bbc

Function at 0x8748c8
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 0x30]
cpuid
mov dl, byte [esp + 2]
xchg word [esp], bp
stc
jmp 0x874900
mov ch, 0xda
xchg byte [esp + 3], dh
xchg di, ax
sub esp, 0
push word [esp + 0xb]
shl ecx, 1
jmp 0x8748ea
Function at 0x874ba5
Capabilities:
Execute anti-debugging instructions

Disassembly:
setge ch
pop dword [esp]
mov esi, 0xbdea1935
pushfd
xchg ah, dh
jmp 0x874b55
xchg cl, ah
xchg esi, ebx
pop esi
neg ax
mov ebx, 0xbcb2dfa9
mov dh, byte [esp]
jmp 0x874b3e
neg eax
xor si, 0xa92a
xchg byte [esp + 5], cl
mov edx, edi
not ah
or eax, 0x27654923
jmp 0x874b11
inc di
mov al, 0x55
bswap ebx
lea esp, [esp + 1]
mov word [esp], dx
jmp 0x874b80
xchg word [esp + 3], dx
xchg ebx, edx
bsr edi, ebp
mov dh, byte [esp + 1]
bswap ebp
setle bl
jmp 0x874b28
lea esi, [ebp*4]
not si
mov cl, dh
pushfd
pop edx
pop dx
jmp 0x874b95
mov di, word [esp]
mov di, si
seto dl
xchg ebx, eax
bsr ax, di
bts di, cx
jmp 0x874b6a
xchg dx, ax
lea esp, [esp]
dec eax
neg ch
cld
call 0x874ba5
pop eax
btr edx, edi
jmp 0x874c34
rdtsc
mov ah, 0xd7
cpuid
mov bh, byte [esp]
rdtsc
mov dword [esp], esi
jmp 0x874c10
add esp, 0
sete bl
xchg di, ax
lea eax, [ebx*4]
jmp 0x874c60
setge bh
rcl edi, cl
mov ebp, 0x87f3d5da
mov di, cx
pop esi
xchg dword [esp], edx
jmp 0x874bd7
pop word [esp]
lea ebx, [edx + ebp]
shl dx, cl
pop di
cmp cx, di
adc ah, 0x91
jmp 0x874be7
mov edi, esp
dec ah
bsf di, dx
mov byte [esp], dh
mov bx, word [esp + 4]
push dword [esp + 3]
jmp 0x874bfd
pop si
xchg byte [esp], dl
or dx, 0x40df
sub esp, 0xf
jmp 0x874e6b
mov byte [esp], al
xchg dh, dl
mov ah, byte [esp]
mov si, 0x3856
mov edx, 0x8c63989
push eax
jmp 0x874c4a
lea ecx, [esi - 0x612a]
setge dl
mov al, ch
mov byte [esp + 6], al
jmp 0x874cd3
rdtsc
mov word [esp + 1], bx
cpuid
push word [esp]
mov bp, word [esp + 5]
mov ah, dl
jmp 0x874c91
push word [esp]
xchg dword [esp + 5], ebp
lea ecx, [0xf5aaa373]
bswap esi
jmp 0x874cf6
cpuid
std
not bp
push edi
push cx
pop bx
jmp 0x874cbd
sub esp, 8
mov cx, ax
lea esi, [edx + esi]
mov word [esp + 4], dx
rdtsc
jmp 0x874d50
btr ecx, edx
lea eax, [edi + ebp]
lea eax, [0x4397eeea]
bswap edx
rdtsc
mov dword [esp + 0xb], edi
jmp 0x874ce0
xchg word [esp + 6], ax
xchg ch, ah
mov bl, byte [esp + 8]
lea ecx, [eax*4]
pop dword [esp + 1]
bswap ebx
jmp 0x874ca7
xchg dword [esp], ecx
rol ch, cl
mov word [esp + 2], sp
xchg dword [esp + 2], esi
jmp 0x874d61
pop ebp
bswap ebp
cld
setb bh
pop word [esp + 0xe]
bsr eax, ebx
jmp 0x874d3a
xchg byte [esp + 0xf], bl
xchg byte [esp + 2], al
rcr eax, cl
or ax, bp
pop dword [esp + 8]
call fcn.00874dfb
jge 0x874dc5
xchg bl, cl
bsf di, ax
neg dl
lea edi, [edx*4]
pop word [esp + 4]
lea edi, [eax*4]
jmp 0x874d1d
add ah, byte [esi - 1]
je 0x874dee
and eax, 0x3424648d
jmp 0x874e16
out dx, eax
mov bh, byte [ecx + 0x67]
aam 0x50
invalid
popal
std
std
clc
call fcn.00874e00
pushal
lea esp, [esp + 0x24]
lea esp, [esp + 2]
push eax
call int.00874e43
cmp al, 0xb5
and eax, 0x241abf4c
lea esp, [esp + 4]
pushfd
push dword [esp]
lea esp, [esp + 2]
jmp 0x874e1f
mov dx, 0x30c1
bswap esi
pop edi
mov word [esp + 0xb], dx
xchg word [esp + 8], di
neg ebp
jmp 0x874d79

Function at 0x874eb5
Capabilities:
Execute anti-debugging instructions

Disassembly:
call fcn.00874e9f
lea esp, [esp + 3]
mov dword [esp + 8], ebp
call fcn.00874f03
xchg esp, eax
pop ds
invalid
Function at 0x874f03
Capabilities:
Access peb ldr_data
Parse pe header

Disassembly:
mov dword [esp + 8], esi
pushal
lea esp, [esp + 0x17]
mov dword [esp + 3], esp
jmp 0x874eed

Function at 0x8816ef
Capabilities:
Decompress data using aplib

Disassembly:
push ebp
mov ebp, esp
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
cld
mov dl, 0x80
movsb byte es:[edi], byte [esi]
call fcn.0088176e
jae 0x8816fb
xor ecx, ecx
call fcn.0088176e
jae 0x881725
xor eax, eax
call fcn.0088176e
jae 0x881736
mov al, 0x10
call fcn.0088176e
adc al, al
jae 0x881717
jne 0x881763
stosb byte es:[edi], al
jmp 0x8816fc
call fcn.0088177a
dec ecx
loop 0x881742
mov eax, ebp
call fcn.00881778
jmp 0x881764
lodsb al, byte [esi]
shr eax, 1
je 0x88178a
adc ecx, 2
mov ebp, eax
jmp 0x881764
xchg ecx, eax
dec eax
shl eax, 8
lodsb al, byte [esi]
mov ebp, eax
call fcn.00881778
cmp eax, 0x7d00
jae 0x881762
cmp eax, 0x500
jae 0x881763
cmp eax, 0x7f
ja 0x881764
inc ecx
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x8816fc
pop ebp
ret 8
Function at 0x405b23
Capabilities:
Delete file
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x258
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
mov eax, ebx
and eax, 4
push edi
mov dword [ebp - 4], eax
call fcn.00405dee
test bl, 8
mov dword [ebp - 8], eax
je 0x405b62
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
neg eax
sbb eax, eax
inc eax
add dword [0x434fa8], eax
jmp 0x405cdf
mov dword [ebp + 8], ebx
and dword [ebp + 8], 1
je 0x405b7c
test eax, eax
je 0x405c8d
test bl, 2
je 0x405c8d
mov esi, str.C:UsersADMINI1AppDataLocalTemp_nse5139.tmpdownload.exe
push edi
push esi
call fcn.00406411
cmp dword [ebp + 8], 0
je 0x405b9b
push str..
push esi
call sub.KERNEL32.dll_lstrcatW
jmp 0x405ba1
push edi
call fcn.00405d32
cmp word [edi], 0
jne 0x405bb1
cmp word [str.C:UsersADMINI1AppDataLocalTemp_nse5139.tmpdownload.exe], 0x5c
jne 0x405bbc
push 0x40a014
push edi
call sub.KERNEL32.dll_lstrcatW
push edi
call sub.KERNEL32.dll_lstrlenW
lea ebx, [edi + eax*2]
lea eax, [ebp - 0x258]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x405c82
cmp word [ebp - 0x22c], 0x2e
jne 0x405c06
cmp word [ebp - 0x22a], 0
je 0x405c65
cmp word [ebp - 0x22a], 0x2e
jne 0x405c06
cmp word [ebp - 0x228], 0
je 0x405c65
lea eax, [ebp - 0x22c]
push eax
push ebx
call fcn.00406411
test byte [ebp - 0x258], 0x10
je 0x405c31
mov eax, dword [ebp + 0xc]
and eax, 3
cmp al, 3
jne 0x405c65
push dword [ebp + 0xc]
push edi
call fcn.00405b23
jmp 0x405c65
push dword [ebp - 4]
push edi
call fcn.00405adb
test eax, eax
jne 0x405c5d
cmp dword [ebp - 4], eax
je 0x405c55
push edi
push 0xfffffffffffffff1
call fcn.00405479
push 0
push edi
call fcn.004061d7
jmp 0x405c65
inc dword [0x434fa8]
jmp 0x405c65
push edi
push 0xfffffffffffffff2
call fcn.00405479
lea eax, [ebp - 0x258]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x405bde
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp dword [ebp + 8], 0
je 0x405c8d
and word [ebx - 2], 0
xor esi, esi
cmp dword [ebp + 8], esi
je 0x405cdf
cmp dword [ebp - 8], esi
jne 0x405ca1
inc dword [0x434fa8]
jmp 0x405cdf
push edi
call fcn.0040676f
test eax, eax
je 0x405cdf
push edi
call fcn.00405ce6
mov eax, dword [ebp - 4]
or al, 1
push eax
push edi
call fcn.00405adb
test eax, eax
jne 0x405cd7
cmp dword [ebp - 4], esi
je 0x405c99
push edi
push 0xfffffffffffffff1
call fcn.00405479
push esi
push edi
call fcn.004061d7
jmp 0x405cdf
push edi
push 0xffffffffffffffe5
call fcn.00405479
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x580770
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x123000]
push edi
jmp 0x58078a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x580791
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x580780
mov eax, 1
add ebx, ebx
jne 0x5807a3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x5807b4
jne 0x5807d3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x5807d3
dec eax
add ebx, ebx
jne 0x5807c0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x580798
add ebx, ebx
jne 0x5807cf
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x580825
xor ecx, ecx
sub eax, 3
jb 0x5807eb
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x58085a
sar eax, 1
mov ebp, eax
jmp 0x5807f6
add ebx, ebx
jne 0x5807f6
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x5807c4
inc ecx
add ebx, ebx
jne 0x580804
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x5807c4
add ebx, ebx
jne 0x580811
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x580806
jne 0x580822
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x580806
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x580844
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x580836
jmp 0x580786
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x580844
add edi, ecx
jmp 0x580786
pop esi
mov edi, esi
mov ecx, 0x40d6
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x580862
cmp byte [edi], 0x11
jne 0x580862
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x580867
lea edi, [esi + 0x179000]
mov eax, dword [edi]
or eax, eax
je 0x5808df
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x21b654]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x21b7d0]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x580894
mov ecx, edi
jns 0x5808c3
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x21b7d4]
or eax, eax
je 0x5808d9
mov dword [ebx], eax
add ebx, 4
jmp 0x5808b1
call dword [esi + 0x21b7e4]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x580910
cmp al, 0xef
ja 0x580903
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x5808e5
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x5808f2
mov ebp, dword [esi + 0x21b7d8]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x23f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x580944
sub esp, 0xffffff80
jmp 0x4204f7
Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
nop
push 4
nop
nop
nop
nop
pop edi
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x42e072
nop
mov ebx, 0x407ef8
nop
nop
nop
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x528f1a85
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x42e060
nop
nop
nop
mov eax, section..data
nop
nop
nop
cmp eax, 0
je 0x42e0d2
nop
nop
nop
nop
nop
mov ebx, 0x42cd70
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
pop eax
nop
nop
nop
nop
nop
mov esi, 0x73607750
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x42e0c0
nop
nop
nop
nop
popal
nop
jmp 0x401219

Function at 0x431005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
mov eax, section..rsrc
push 4
nop
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
nop
je 0x431072
nop
nop
mov ebx, 0x40915c
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x54a37845
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
loop 0x431060
nop
nop
nop
nop
mov eax, section..data
cmp eax, 0
nop
nop
nop
nop
nop
nop
je 0x4310d2
nop
nop
mov ebx, 0x42f3f8
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
nop
nop
div edi
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
nop
mov esi, 0x513769d8
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x4310c0
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x401219