joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4078f3
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42e9d8]
jne 0x4078fd
repz ret
jmp fcn.0040ae93

Function at 0x40ac74
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00405b8e
and dword [ebp - 4], 0
cmp dword [0x436580], 0
mov ebx, eax
jne 0x40ad25
push 0x4022dc
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x40add6
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x4022d0
push edi
call esi
test eax, eax
je 0x40add6
push eax
call fcn.00405b1c
mov dword [esp], 0x4022c0
push edi
mov dword [0x436580], eax
call esi
push eax
call fcn.00405b1c
mov dword [esp], 0x4022ac
push edi
mov dword [0x436584], eax
call esi
push eax
call fcn.00405b1c
mov dword [esp], 0x402290
push edi
mov dword [0x436588], eax
call esi
push eax
call fcn.00405b1c
pop ecx
mov dword [0x436590], eax
test eax, eax
je 0x40ad25
push 0x402278
push edi
call esi
push eax
call fcn.00405b1c
pop ecx
mov dword [0x43658c], eax
mov eax, dword [0x43658c]
cmp eax, ebx
je 0x40ad7d
cmp dword [0x436590], ebx
je 0x40ad7d
push eax
call fcn.00405b97
push dword [0x436590]
mov esi, eax
call fcn.00405b97
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x40ad7d
test edi, edi
je 0x40ad7d
call esi
test eax, eax
je 0x40ad74
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x40ad74
test byte [ebp - 0xc], 1
jne 0x40ad7d
or dword [ebp + 0x10], 0x200000
jmp 0x40adb6
mov eax, dword [0x436584]
cmp eax, ebx
je 0x40adb6
push eax
call fcn.00405b97
pop ecx
test eax, eax
je 0x40adb6
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x40adb6
mov eax, dword [0x436588]
cmp eax, ebx
je 0x40adb6
push eax
call fcn.00405b97
pop ecx
test eax, eax
je 0x40adb6
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x436580]
call fcn.00405b97
pop ecx
test eax, eax
je 0x40add6
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x40add8
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x401687
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x38
mov eax, dword [0x581a60]
xor eax, esp
mov dword [esp + 0x34], eax
mov ecx, dword [esi + 0x20]
push ebx
push edi
lea eax, [esp + 0x2c]
xor edi, edi
push eax
push ecx
mov dword [esp + 0x34], edi
mov dword [esp + 0x38], edi
mov dword [esp + 0x3c], edi
mov dword [esp + 0x40], edi
call dword [fcn.00536724]
fld qword [esi + 0x88]
mov eax, dword [esp + 0x34]
fmul qword [0x560e70]
mov ebx, dword [esp + 0x38]
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x30]
mov dword [esp + 0x28], ebx
mov dword [esp + 0x18], ebx
lea ebx, [eax - 0x50]
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x14], eax
mov dword [esp + 0x20], edx
mov dword [esp + 0x24], eax
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x1c], ebx
call fcn.00513f57
mov dword [esp + 0x28], eax
mov dword [esp + 0x18], eax
cmp dword [esi + 0x7c], edi
jg 0x40174f
mov eax, dword [esi + 0x7c]
lea edx, [eax + eax*4]
add edx, edx
add edx, edx
mov dword [esp + 8], edx
fild dword [esp + 8]
fmul qword [esi + 0x88]
call fcn.00513f57
mov ecx, dword [esp + 0x3c]
pop edi
pop ebx
xor ecx, esp
call 0x50dc32
mov esp, ebp
pop ebp
ret
mov eax, dword [esp + 0x18]
mov ebx, dword [esp + 0x14]
test edi, edi
js 0x4017f5
cmp edi, dword [esi + 0x7c]
jge 0x4017f5
mov edx, dword [esi + 0x78]
mov ecx, dword [edx + edi*4]
mov edx, dword [esp + 0x10]
push 1
sub eax, edx
push eax
mov eax, dword [esp + 0x14]
sub ebx, eax
push ebx
push edx
mov dword [esp + 0x18], ecx
push eax
add ecx, 0x138
call fcn.00416099
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x24]
push 1
sub ecx, eax
push ecx
mov ecx, dword [esp + 0x24]
sub edx, ecx
push edx
push eax
push ecx
mov ecx, dword [esp + 0x1c]
call fcn.00416099
fld qword [esi + 0x88]
fmul qword [0x560e70]
call fcn.00513f57
mov ebx, dword [0x536728]
push eax
push 0
lea eax, [esp + 0x14]
push eax
call ebx
fld qword [esi + 0x88]
fmul qword [0x560e70]
call fcn.00513f57
push eax
push 0
lea ecx, [esp + 0x24]
push ecx
call ebx
inc edi
cmp edi, dword [esi + 0x7c]
jl 0x401747
jmp 0x401717
call fcn.0041a2c0
int3

Function at 0x436c45
Capabilities:
Encode data using xor

Disassembly:
fadd dword [eax - 0x6f]
push eax
clc
xor cl, bh
nop
adc bh, cl
neg dword ss:[edi + 1]
imul edx, dword [eax], 0x4c
xor ecx, edi
aad 0x17
dec edi
sub ecx, dword [ebx + esi + 0x7d631b1d]
mov esi, ss
les eax, [ebx - 0x108beda1]
call 0xa84b50aa
invalid

Function at 0x445de7
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x38
mov eax, dword [0x581a60]
xor eax, esp
mov dword [esp + 0x34], eax
mov ecx, dword [esi + 0x20]
push ebx
push edi
lea eax, [esp + 0x2c]
xor edi, edi
push eax
push ecx
mov dword [esp + 0x34], edi
mov dword [esp + 0x38], edi

Function at 0x445e10
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov dword [esp + 0x3c], edi
mov dword [esp + 0x40], edi
call dword [fcn.00536724]
fld qword [esi + 0x88]
Function at 0x445e24
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [esp + 0x34]
fmul qword [0x560e70]
mov ebx, dword [esp + 0x38]
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x30]
mov dword [esp + 0x28], ebx
mov dword [esp + 0x18], ebx
lea ebx, [eax - 0x50]
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x14], eax
mov dword [esp + 0x20], edx
mov dword [esp + 0x24], eax
inc esp
and al, 0x24
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x1c], ebx
call fcn.005586b7
mov dword [esp + 0x28], eax
mov dword [esp + 0x18], eax
cmp dword [esi + 0x7c], edi
jg 0x445eaf
mov eax, dword [esi + 0x7c]
lea edx, [eax + eax*4]
add edx, edx
rol byte [ebx], cl
ror byte [ecx - 0x24f7dbac], cl
inc esp
and al, 8
fmul qword [esi + 0x88]
call fcn.005586b7
mov ecx, dword [esp + 0x3c]
pop edi
pop ebx
xor ecx, esp
call fcn.00552392
mov esp, ebp
pop ebp
ret
mov eax, dword [esp + 0x18]
mov ebx, dword [esp + 0x14]
test edi, edi
js 0x445f55
cmp edi, dword [esi + 0x7c]
jge 0x445f55
mov edx, dword [esi + 0x78]
mov ecx, dword [edx + edi*4]
mov edx, dword [esp + 0x10]
push 1
sub eax, edx
push eax
mov eax, dword [esp + 0x14]
sub ebx, eax
push ebx
push edx
mov dword [esp + 0x18], ecx
push eax
add ecx, 0x138
call int.0045a7f9
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x24]
push 1
sub ecx, eax
push ecx
mov ecx, dword [esp + 0x24]
sub edx, ecx
push edx
push eax
push ecx
mov ecx, dword [esp + 0x1c]
call int.0045a7f9
fld qword [esi + 0x88]
fmul qword [0x560e70]
or eax, 0x560e70
call fcn.005586b7
mov ebx, dword [0x536728]
push eax
push 0
lea eax, [esp + 0x14]
push eax
call ebx
fld qword [esi + 0x88]
fmul qword [0x560e70]
call fcn.005586b7
push eax
push 0
lea ecx, [esp + 0x24]
push ecx
call ebx
inc edi
cmp edi, dword [esi + 0x7c]
jl 0x445ea7
jmp 0x445e77
call fcn.0045ea20
int3
Function at 0x4512c7
Capabilities:
Encode data using xor

Disassembly:
out 0xf9, al
mov ah, 0xaa
add byte [edx + ecx*8 - 0x60], bh
mov ah, 0xa1
xor al, 0xbc
sahf
lodsd eax, dword [esi]
mov al, byte [0xdba35670]
adc esp, 0xb9f69985
cmpsb byte [esi], byte es:[edi]
mul byte [edx + 0x42b4f9f8]
mov byte [0x42b4f9f8], al
inc edx
call 0xd3a376dd
jle 0x451243
xchg ecx, eax
test byte [ebp + 0x18], bh
cmc
test byte [0x3cb8b421], ch
xchg ebp, eax
cld
push cs
jne 0x451263
mov al, byte [0x116da7d4]
pop ss
test al, 0x6e
insb byte es:[edi], dx
xchg esp, eax
cmp al, 0xf8
jno 0x4512fd
mov al, 0x18
rcr dword [ebp + 0x74], 0xc8
stosb byte es:[edi], al
sahf
jge 0x451307
mov ah, 0xd4
or eax, 0x50d280da
mov ah, 0x14
xchg esp, eax
invalid
cmpsb byte gs:[esi], byte es:[edi]
jne 0x45125f
hlt
pop ecx
mov esp, 0xb389b330
add byte [ecx - 0x389c0a80], dh
arpl di, ax
pop ebp
mov cl, 0xaf
push eax
mov bh, 0xd7
cwde
mov ah, 0xba
dec ecx
neg byte [eax - 0x24484ff5]
std
test byte [edi + ebx*8], bl
xchg esp, eax
cmp dword [ebp - 0x583d62c8], esp
mov dword [ecx + 3], esi
add dword [edi - 0x1a], ebp
movsd dword es:[edi], dword [esi]
cmc
test eax, 0x943287ed
ror dword gs:[0x69c7a0bd], 1
mov ebp, 0xbfcb48a1
mov edi, 0x5f879067
inc esp
mov bh, 0x65
and al, byte [ebp + 0x7aa0b19f]
in al, 0x42
out 0x54, al
insd dword es:[edi], dx
mov dword [ecx + 0x1a], edx
mov eax, dword [0x65bda040]
out dx, eax
leave
in al, 0xb1
salc
adc eax, 0xa7a55475
push esp
movsd dword es:[edi], dword [esi]
cmpsd dword [esi], dword es:[edi]
lcall 0xd935, 0xe5bd68f6
out dx, al
out dx, eax
std
and byte [ebx], dh
test al, 0x71
sti
add byte [esi - 0x63], dl
rcl bl, cl
salc
fnstsw word [ebx + 0x75]
mov bh, 0x32
mov ebx, 0x2122f49b
push ebp
rcl dword [esi - 0x6a8c0c3c], cl
js 0x451361
xchg esi, eax
push esp
not al
xchg edi, eax
movsd dword es:[edi], dword [esi]
aam 0xd3
sti
shl dword [esi], 0xfd
stc
test byte [edi - 0x7f], dl
aam 0x41
invalid

Function at 0x452527
Capabilities:
Encode data using xor

Disassembly:
shl dword [esi + 0x67973bf8], 1
and dword [edi + ebx], edi
push edx
adc dword [esi], 0x70a2f711
aam 0xd0
add dword [eax], ecx
mul dword [edx + 0x1d0d470]
or al, 0xa0
dec esi
ror cl, 1
sub eax, esp
outsd dx, dword [esi]
xor byte [edx - 0x6e], ah
inc eax
jo 0x452534
or al, 0xe2
sbb edi, dword [esi - 0x5d3e2fa6]
mov bl, 0x25
inc eax
sal byte [ecx], cl
xor dword [0x26d98041], ebp
invalid
Function at 0x4669d7
Capabilities:
Encode data using xor

Disassembly:
fisttp word [edi - 0x44]
sti
stosd dword es:[edi], eax
inc esi
int 0xf3
jg 0x4669de
sbb eax, 0x1d4980d8
mov dword [0xe6c3f3ad], eax
hlt
adc eax, 0xfa6af632
arpl si, cx
xor ch, byte [esi - 0x2997e5b0]
salc
xor cl, byte [ebp + 0x35]
outsb dx, byte [esi]
mov byte [0x2082e0bf], al
aam 0x4c
and ah, dl
dec esp
jle 0x4669da
adc eax, 0xd4506280
push ebx
lodsb al, byte [esi]
bnd js 0x4669b2
int1
je 0x4669dc
rcr ch, 0x54
push edi
dec edi
pop ss
add eax, 0x7ff656dd
push eax
loopne 0x466981
movsd dword es:[edi], dword [esi]
mov dh, 0x18
imul ebx, dword [edi], 0x5d
dec esi
jne 0x466a44
cmp dword [eax - 0x15581ae], eax
jb 0x46699d
push edx
jle 0x466989
stosb byte es:[edi], al
invalid
mov ebp, ds
mov byte [0xb432225b], al
pop esp
mov ah, 0x5c
jmp 0x4669a9
push ebp
loope 0x4669c0
int3
inc edx
js 0x4669e8
sbb al, 0x6c
or dword [ebx], ebx
push edi
and bh, dh
sbb al, 0x94
sbb ch, ah
pushfd
jae 0x4669f9
sbb eax, 0x5a24cdd0
or eax, 0x5a75d25e
and ebx, 0x4e
sbb esi, 0x5b
dec eax
lodsb al, byte [esi]
lodsd eax, dword [esi]
push esp
mov cl, al
jecxz 0x466aec
or dl, byte [ebx + 0x42]
arpl word [edx], ax
cwde
fcom dword [ecx - 0xf65eb13]
jnp 0x466aa8
lodsb al, byte [esi]
xchg edx, eax
sbb eax, 0xa1bb4ba5
sar byte [edi + 0x2c620202], cl
mov dl, 8
pop ebx
salc
cmpsd dword [esi], dword es:[edi]
aas
invalid
add bh, ah
adc dl, byte [esp + esi*2 + 0x3a]
or ecx, dword [ecx + esi*4 - 0x2fea6cfc]
in al, 0xdf
fdivr qword [edx]
int 0xb9
jge 0x466afc
xor dl, byte [edi - 0xb]
sub byte [ecx - 0x2f352dfd], 0x9d
jg 0x466ac2
and dword [ebx], eax
ror dl, cl
rcr byte [ebp + 0x6465f87f], 1
clc
clc
jnp 0x466b47
mov byte [0xd6c749ea], al
jmp 0x1f44cca5
and dword [esi + 0x7d], ebx
in al, dx
jo 0x466a8b
mov edx, 0xeff07072
mov bh, 0x49
mov dh, 0x21
dec edi
or al, 0x43
mov byte [edi], bh
rcr byte [ecx + 0x2860d13e], cl
pop ebx
lcall 0x2a50, 0x3eb16870
adc dword [esi + 0x1c], ebp
aaa
xchg esi, eax
faddp st(2)
xor byte [ecx + 0x3c], dl
fcomp dword [esi]
shr dword [esi - 0x39], 0x7d
scasd eax, dword es:[edi]
jl 0x466b00
rcr bl, cl
cld
or dword [ebx + 0x78], 0xe346d76
sub dh, byte [ecx + ecx*8 - 0xe]
insb byte es:[edi], dx
pop eax
mov dword [0x7e02fe70], eax
cmp ebp, dword [edi]
add bh, byte [esi + 0x3b]
das
xor bh, ch
jo 0x466b92
int1
pop ebp
pushal
jle 0x466b34
push ss
adc al, 0x56
mov edi, 0x28bd8b9e
push eax
aam 0xc9
mov ebp, 0xc9d45028
invalid
mov esp, 0x7df561df
lodsd eax, dword [esi]
and esp, ecx
insb byte es:[edi], dx
mov edi, 0x1f576750
xchg ecx, eax
retf 0xc0ca
Function at 0x473647
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x38
mov eax, dword [0x581a60]
xor eax, esp
mov dword [esp + 0x34], eax
mov ecx, dword [esi + 0x20]
push ebx
push edi
lea eax, [esp + 0x2c]
xor edi, edi
push eax
push ecx
mov dword [esp + 0x34], edi
mov dword [esp + 0x38], edi
mov dword [esp + 0x3c], edi
mov dword [esp + 0x40], edi
call dword [fcn.00536724]
fld qword [esi + 0x88]
mov eax, dword [esp + 0x34]
fmul qword [0x560e70]
mov ebx, dword [esp + 0x38]
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x30]
mov dword [esp + 0x28], ebx
mov dword [esp + 0x18], ebx
lea ebx, [eax - 0x50]
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x14], eax
mov dword [esp + 0x20], edx
mov dword [esp + 0x24], eax
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x1c], ebx
call fcn.00585f17
mov dword [esp + 0x28], eax
mov dword [esp + 0x18], eax
cmp dword [esi + 0x7c], edi
jg 0x47370f
mov eax, dword [esi + 0x7c]
lea edx, [eax + eax*4]
add edx, edx
add edx, edx
mov dword [esp + 8], edx
fild dword [esp + 8]
fmul qword [esi + 0x88]
call fcn.00585f17
mov ecx, dword [esp + 0x3c]
pop edi
pop ebx
xor ecx, esp
call fcn.0057fbf2
mov esp, ebp
pop ebp
ret
mov eax, dword [esp + 0x18]
mov ebx, dword [esp + 0x14]
test edi, edi
js 0x4737b5
cmp edi, dword [esi + 0x7c]
jge 0x4737b5
mov edx, dword [esi + 0x78]
mov ecx, dword [edx + edi*4]
mov edx, dword [esp + 0x10]
push 1
sub eax, edx
push eax
mov eax, dword [esp + 0x14]
sub ebx, eax
push ebx
push edx
mov dword [esp + 0x18], ecx
push eax
add ecx, 0x138
call fcn.00488059
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x24]
push 1
sub ecx, eax
push ecx
mov ecx, dword [esp + 0x24]
sub edx, ecx
push edx
push eax
push ecx
mov ecx, dword [esp + 0x1c]
call fcn.00488059
fld qword [esi + 0x88]
fmul qword [0x560e70]
call fcn.00585f17
mov ebx, dword [0x536728]
push eax
push 0
lea eax, [esp + 0x14]
push eax
call ebx
fld qword [esi + 0x88]
fmul qword [0x560e70]
call fcn.00585f17
push eax
push 0
lea ecx, [esp + 0x24]
push ecx
call ebx
inc edi
cmp edi, dword [esi + 0x7c]
jl 0x473707
jmp 0x4736d7
call fcn.0048c280
int3

Function at 0x488015
Capabilities:
Encode data using xor

Disassembly:
push eax
xchg edi, eax
add al, 0x24
xor dword [ebp + 0x25c7ac80], eax
dec edx
and byte [ebp + 0x4c310917], bh
popal
jecxz 0x488019
ror dword [edi + edx*8 - 0x79], 1
ret
Function at 0x48a8e7
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x38
mov eax, dword [0x581a60]
xor eax, esp
mov dword [esp + 0x34], eax
mov ecx, dword [esi + 0x20]
push ebx
push edi
lea eax, [esp + 0x2c]
xor edi, edi
push eax
push ecx
mov dword [esp + 0x34], edi
mov dword [esp + 0x38], edi
mov dword [esp + 0x3c], edi
mov dword [esp + 0x40], edi
call dword [fcn.00536724]
fld qword [esi + 0x88]
mov eax, dword [esp + 0x34]
fmul qword [0x560e70]
mov ebx, dword [esp + 0x38]
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x30]
mov dword [esp + 0x28], ebx
mov dword [esp + 0x18], ebx
lea ebx, [eax - 0x50]
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x14], eax
mov dword [esp + 0x20], edx
mov dword [esp + 0x24], eax
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x1c], ebx
call fcn.0059d1b7
mov dword [esp + 0x28], eax
mov dword [esp + 0x18], eax
cmp dword [esi + 0x7c], edi
jg 0x48a9af
mov eax, dword [esi + 0x7c]
lea edx, [eax + eax*4]
add edx, edx
add edx, edx
mov dword [esp + 8], edx
fild dword [esp + 8]
fmul qword [esi + 0x88]
call fcn.0059d1b7
mov ecx, dword [esp + 0x3c]
pop edi
pop ebx
xor ecx, esp
call fcn.00596e92
mov esp, ebp
pop ebp
ret
mov eax, dword [esp + 0x18]
mov ebx, dword [esp + 0x14]
test edi, edi
js 0x48aa55
cmp edi, dword [esi + 0x7c]
jge 0x48aa55
mov edx, dword [esi + 0x78]
mov ecx, dword [edx + edi*4]
mov edx, dword [esp + 0x10]
push 1
sub eax, edx
push eax
mov eax, dword [esp + 0x14]
sub ebx, eax
push ebx
push edx
mov dword [esp + 0x18], ecx
push eax
add ecx, 0x138
call fcn.0049f2f9
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x24]
push 1
sub ecx, eax
push ecx
mov ecx, dword [esp + 0x24]
sub edx, ecx
push edx
push eax
push ecx
mov ecx, dword [esp + 0x1c]
call fcn.0049f2f9
fld qword [esi + 0x88]
fmul qword [0x560e70]
call fcn.0059d1b7
mov ebx, dword [0x536728]
push eax
push 0
lea eax, [esp + 0x14]
push eax
call ebx
fld qword [esi + 0x88]
fmul qword [0x560e70]
call fcn.0059d1b7
push eax
push 0
lea ecx, [esp + 0x24]
push ecx
call ebx
inc edi
cmp edi, dword [esi + 0x7c]
jl 0x48a9a7
jmp 0x48a977
call fcn.004a3520
int3
Function at 0x4a17c7
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x38
mov eax, dword [0x581a60]
xor eax, esp
mov dword [esp + 0x34], eax
mov ecx, dword [esi + 0x20]
push ebx
push edi
lea eax, [esp + 0x2c]
xor edi, edi
push eax
push ecx
mov dword [esp + 0x34], edi
mov dword [esp + 0x38], edi
mov dword [esp + 0x3c], edi
mov dword [esp + 0x40], edi
call dword [fcn.00536724]
fld qword [esi + 0x88]
mov eax, dword [esp + 0x34]
fmul qword [0x560e70]
mov ebx, dword [esp + 0x38]
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x30]
mov dword [esp + 0x28], ebx
mov dword [esp + 0x18], ebx
lea ebx, [eax - 0x50]
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x14], eax
mov dword [esp + 0x20], edx
mov dword [esp + 0x24], eax
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x1c], ebx
call fcn.005b4097
mov dword [esp + 0x28], eax
mov dword [esp + 0x18], eax
cmp dword [esi + 0x7c], edi
jg 0x4a188f
mov eax, dword [esi + 0x7c]
lea edx, [eax + eax*4]
add edx, edx
add edx, edx
mov dword [esp + 8], edx
fild dword [esp + 8]
fmul qword [esi + 0x88]
call fcn.005b4097
mov ecx, dword [esp + 0x3c]
pop edi
pop ebx
xor ecx, esp
call fcn.005add72
mov esp, ebp
pop ebp
ret
mov eax, dword [esp + 0x18]
mov ebx, dword [esp + 0x14]
test edi, edi
js 0x4a1935
cmp edi, dword [esi + 0x7c]
jge 0x4a1935
mov edx, dword [esi + 0x78]
mov ecx, dword [edx + edi*4]
mov edx, dword [esp + 0x10]
push 1
sub eax, edx
push eax
mov eax, dword [esp + 0x14]
sub ebx, eax
push ebx
push edx
mov dword [esp + 0x18], ecx
push eax
add ecx, 0x138
call fcn.004b61d9
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x24]
push 1
sub ecx, eax
push ecx
mov ecx, dword [esp + 0x24]
sub edx, ecx
push edx
push eax
push ecx
mov ecx, dword [esp + 0x1c]
call fcn.004b61d9
fld qword [esi + 0x88]
fmul qword [0x560e70]
call fcn.005b4097
mov ebx, dword [0x536728]
push eax
push 0
lea eax, [esp + 0x14]
push eax
call ebx
fld qword [esi + 0x88]
fmul qword [0x560e70]
call fcn.005b4097
push eax
push 0
lea ecx, [esp + 0x24]
push ecx
call ebx
inc edi
cmp edi, dword [esi + 0x7c]
jl 0x4a1887
jmp 0x4a1857
call fcn.004ba400
int3

Function at 0x4b7534
Capabilities:
Encode data using xor

Disassembly:
adc dword [ebp - 0x5e3ce0f0], 0x3f
or esi, dword [edx]
pop ss
scasb al, byte es:[edi]
dec ecx
ror ecx, cl
aad 0x1a
sbb dword [ebp - 0x2fbf4a0c], ecx
sub byte [eax + 0x72e7065], dl
mov dword [0x12349fa1], eax
nop
push esi
push ebx
sbb cl, byte [ecx + 0x2d]
or cl, dl
in eax, 0xc4
loope 0x4b74b4
rcr dword [edx], 0x73
retf
jg 0x4b74bb
push esi
call 0x657a6018
or al, 0x45
aas
invalid
Function at 0x4b91b1
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x4c1378
cmp edx, dword [eax]
je 0x4b91d3
add eax, 8
inc ecx
cmp eax, 0x4c1408
jl 0x4b91c4
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x4c1378]
jne 0x4b9301
mov eax, dword [0x4c5cfc]
cmp eax, 1
je 0x4b92db
test eax, eax
jne 0x4b9204
cmp dword [0x4c12a0], 1
je 0x4b92db
cmp edx, 0xfc
je 0x4b9301
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4b923b
lea eax, [ebp - 0x1a4]
push 0x4be7c8
push eax
call fcn.004b9b90
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.004ba020
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x4b927e
lea eax, [ebp - 0x1a4]
push eax
call fcn.004ba020
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x4be7c4
push edi
call fcn.004bbef0
add esp, 0x10
lea eax, [ebp - 0xa0]
push 0x4be7a8
push eax
call fcn.004b9b90
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.004b9ba0
lea eax, [ebp - 0xa0]
push 0x4be7a4
push eax
call fcn.004b9ba0
push dword [esi + 0x4c137c]
lea eax, [ebp - 0xa0]
push eax
call fcn.004b9ba0
push 0x12010
lea eax, [ebp - 0xa0]
push 0x4be77c
push eax
call fcn.004bbe64
add esp, 0x2c
pop edi
jmp 0x4b9301
lea eax, [ebp + 8]
lea esi, [esi + 0x4c137c]
push 0
push eax
push dword [esi]
call fcn.004ba020
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x429ee0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x1d000]
push edi
or ebp, 0xffffffff
jmp 0x429f02
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x429f09
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x429ef8
mov eax, 1
add ebx, ebx
jne 0x429f1b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x429f10
jne 0x429f2c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x429f10
xor ecx, ecx
sub eax, 3
jb 0x429f40
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x429fb2
mov ebp, eax
add ebx, ebx
jne 0x429f4b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x429f58
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x429f7c
inc ecx
add ebx, ebx
jne 0x429f68
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x429f5d
jne 0x429f79
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x429f5d
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x429f9c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x429f8d
jmp 0x429efe
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x429f9c
add edi, ecx
jmp 0x429efe
pop esi
mov edi, esi
mov ecx, 0x5b7
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x429fba
cmp byte [edi], 0xa
jne 0x429fba
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov eax, ebx
loop 0x429fbf
lea edi, [esi + 0x27000]
mov eax, dword [edi]
or eax, eax
je 0x42a02e
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x2a000]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x2a050]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x429fec
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x2a054]
or eax, eax
je 0x42a028
mov dword [ebx], eax
add ebx, 4
jmp 0x42a009
call dword [esi + 0x2a058]
popal
jmp 0x40a9e8
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
nop
nop
nop
nop
nop
pop eax
add eax, 0x403daa
nop
nop
sub eax, 0x403d50
nop
nop
mov ebx, dword [eax]
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
jl 0x430030
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
jne 0x43001e
nop
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp loc.00401219