joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401184
Capabilities:
Encode data using xor

Disassembly:
push 0x401d30
call sub.MSVBVM60.DLL_ThunRTMain
add byte [eax], al
add byte [eax], al
add byte [eax], al
xor byte [eax], al
add byte [eax], al
cmp byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
inc esp
jl 0x401190
inc esp
lodsb al, byte [esi]
and eax, 0x39ae11dd
add al, ah
dec esp
inc ebx
pop ds
jne 0x4011b1
add byte [eax], al
add byte [eax], al
add byte [ecx], al
add byte [eax], al
add byte [eax], al
or cl, al
inc eax
add byte [ecx + 0x31ccb3a4], bh
add byte [esi + 1], dh
add byte [eax], al
add byte [eax], al
dec esp
xor dword [eax], eax
or byte [esp + edi*2], bl
sbb al, 0x7c
in eax, dx
inc esp
lodsb al, byte [esi]
and eax, 0x39ae11dd
add al, ah
dec esp
inc ebx
pop ds
jne 0x4011ff
jl 0x4011d1
inc esp
lodsb al, byte [esi]
and eax, 0x39ae11dd
add al, ah
dec esp
inc ebx
pop ds
jne 0x40122c
dec edi
lodsd eax, dword [esi]
xor ebx, dword [ecx - 0x48ee309a]
or al, 0
stosb byte es:[edi], al
add byte [eax - 0x2d], ah
xchg ebx, eax
add byte [eax], al
add byte [eax], al
rcl dword [ebx], cl
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
adc cl, byte [eax]
add byte [eax], al
dec ecx
add eax, dword [eax]
add byte [eax], al
or dword [eax], eax
jb 0x4012a0
push ebx
jo 0x4012a2
popal
jae 0x4012a1
add byte [0x42000119], cl
add byte [edx], ah
add dword [ebx], esp
push es
add eax, dword [eax]
add byte [esp + esi*2], ch
add dh, bh
add al, byte [eax]
add byte [eax], al
add byte [ecx], al
add byte [ecx], al
add byte [eax], ah
and byte [eax + eax], al
add byte [eax], al
add byte [eax], al
call 0x16401264
add byte [eax], al
add byte [eax], ch
add byte [eax], al
add byte [eax], ah
add byte [eax], al
add byte [eax], al
add byte [eax], al
add dword [eax], eax
add al, 0
add byte [eax], al
add byte [eax], al
add byte [edx], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], 0
add byte [eax], 0
add byte [eax + 0x800080], al
add byte [eax], al
add byte [eax - 0x7fff8000], al
add byte [eax], 0
rol al, 0xc0
add byte [eax + 0x8080], al
add bh, bh
add byte [eax], 0x80
add byte [eax - 0x3fffff80], al
add byte [eax + 0x808000], al
add al, al
rol al, 0
add byte [eax + 0x80], 0xff
add byte [eax], al
inc dword [eax]
add byte [eax], al
invalid
Function at 0x404b24
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
pushal
call 0x404b33
pop dword [ebp - 0x18]
mov eax, 0xb81447a8
sub eax, 0xb7d3fc75
sub dword [ebp - 0x18], eax
mov dword [ebp - 0x28], 0x7c3ab796
sub dword [ebp - 0x28], 0x2de8724b
mov dword [ebp - 0x24], 0x21bca6dc
sub dword [ebp - 0x24], 0xef895a97
mov dword [ebp - 0x20], 0x2f209de9
sub dword [ebp - 0x20], 0xe2d459bb
mov dword [ebp - 0x1c], 0xf211c2f2
sub dword [ebp - 0x1c], 0xf211c2f2
lea eax, [ebp - 0x28]
push eax
mov eax, 0xb5307c9f
add eax, 0x4b11b3d5
add eax, dword [ebp - 0x18]
call dword [eax]
mov dword [ebp - 0x28], 0x6883967e
add dword [ebp - 0x28], 0xbeed2d8
mov dword [ebp - 0x24], 0x9bb849be
add dword [ebp - 0x24], 0xa5b417b7
mov dword [ebp - 0x20], 0x2d408f06
sub dword [ebp - 0x20], 0xc9d1229a
mov dword [ebp - 0x1c], 0x6cf7f0cd
sub dword [ebp - 0x1c], 0x6cf7f0cd
lea ebx, [ebp - 0x28]
push ebx
push eax
mov eax, 0x6e205b9f
add eax, 0x9221d585
add eax, dword [ebp - 0x18]
call dword [eax]
push 0x40
push 0x1000
push 0x3e5d0
push 0
call eax
mov ecx, 0x16452c31
add ecx, 0xe9bb1e5f
mov edi, eax
mov edx, 0x434400
add edx, dword [ebp - 0x18]
mov esi, 0x539b1998
add esi, 0xb3cfa06a
add dword [ebp - 8], edi
mov ebx, dword [edx]
xor dword [ebp - 8], edx
xor ebx, esi
sub dword [ebp - 0x10], esi
mov dword [edi], ebx
mov dword [ebp - 0x14], 0x696cfbfb
add edi, 0x3bea8608
add edi, 0xc41579fc
add edx, 0x8ee87f0b
add edx, 0x711780f9
loop 0x404c4f
add eax, 0x1c18e05a
add eax, 0xe3e83cb9
mov ebx, eax
add eax, 0xfce2e4f0
sub eax, 0xfce2e4eb
mov ecx, 0x967551
sub ecx, 0x567551
add ecx, dword [ebp - 0x18]
call ebx
leave
ret

Function at 0x407e15
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42e180]
jne 0x407e1f
repz ret
jmp fcn.0040bc0c

Function at 0x5199b9
Capabilities:
Decompress data using aplib

Disassembly:
push ebp
mov ebp, esp
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
cld
mov dl, 0x80
movsb byte es:[edi], byte [esi]
call fcn.00519a38
jae 0x5199c5
xor ecx, ecx
call fcn.00519a38
jae 0x5199ef
xor eax, eax
call fcn.00519a38
jae 0x519a00
mov al, 0x10
call fcn.00519a38
adc al, al
jae 0x5199e1
jne 0x519a2d
stosb byte es:[edi], al
jmp 0x5199c6
call fcn.00519a44
dec ecx
loop 0x519a0c
mov eax, ebp
call fcn.00519a42
jmp 0x519a2e
lodsb al, byte [esi]
shr eax, 1
je 0x519a54
adc ecx, 2
mov ebp, eax
jmp 0x519a2e
xchg ecx, eax
dec eax
shl eax, 8
lodsb al, byte [esi]
mov ebp, eax
call fcn.00519a42
cmp eax, 0x7d00
jae 0x519a2c
cmp eax, 0x500
jae 0x519a2d
cmp eax, 0x7f
ja 0x519a2e
inc ecx
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x5199c6
pop ebp
ret 8
Function at 0x10012fc0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
pushal
call 0x10012fcf
pop dword [ebp - 0x20]
mov eax, 0x10012fcf
sub dword [ebp - 0x20], eax
mov dword [ebp - 0x30], 0x166c73e6
sub dword [ebp - 0x30], 0xc81a2e9b
mov dword [ebp - 0x2c], 0xf6bb7a16
add dword [ebp - 0x2c], 0x3b77d22f
mov dword [ebp - 0x28], 0x3e6877ff
sub dword [ebp - 0x28], 0xf21c33d1
mov dword [ebp - 0x24], 0x8244e1ca
add dword [ebp - 0x24], 0x7dbb1e36
lea eax, [ebp - 0x30]
push eax
mov eax, 0x4aa633be
add eax, 0xc55b8c9a
add eax, dword [ebp - 0x20]
call dword [eax]
mov dword [ebp - 0x30], 0x4b87af11
sub dword [ebp - 0x30], 0xd71545bb
mov dword [ebp - 0x2c], 0xde990103
sub dword [ebp - 0x2c], 0x9d2c9f8e
mov dword [ebp - 0x28], 0x3498c7b3
add dword [ebp - 0x28], 0x2ed6a4b9
mov dword [ebp - 0x24], 0x51922ebc
sub dword [ebp - 0x24], 0x51922ebc
lea ebx, [ebp - 0x30]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x20]
call dword [eax]
push 0x40
push 0x1000
push 0x3b67f
push 0
call eax
mov ecx, 0x3b1497aa
add ecx, 0xc4ebafa2
xor edi, edi
add edi, eax
mov edx, 0x10028800
add edx, dword [ebp - 0x20]
mov esi, 0x234ebaa7
sub esi, 0x7bcda05a
xor dword [ebp - 8], 0xafb27c26
mov ebx, dword [edx]
mov dword [ebp - 0x18], 0x2cfe3f79
xor ebx, esi
xor dword [ebp - 0x10], 0xc34c2b25
mov dword [edi], ebx
add dword [ebp - 0x10], 0xf768730c
add edi, 0xab10e37d
add edi, 0x54ef1c87
add edx, 4
loop 0x100130e3
add eax, 0x11003
xor ebx, ebx
add ebx, eax
add eax, 0x55d0209
add eax, 0xfaa2fdfc
mov ecx, 0x10000000
add ecx, dword [ebp - 0x20]
call ebx
leave
ret
Function at 0x9b05f0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
mov eax, dword [0x9b64cc]
cmp dword [eax + 0x28], 0
jne 0x9b0608
xor eax, eax
jmp 0x9b0737
mov ecx, dword [0x9b643c]
mov dword [ebp - 0x20], ecx
mov edx, dword [ebp - 0x20]
add edx, 0xe
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 4]
mov dword [0x9b6430], ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx + 8]
mov dword [0x9b642c], eax
push 0
call dword [0x9b4138]
mov dword [ebp - 0x10], eax
push 1
call dword [0x9b4138]
mov dword [ebp - 0x18], eax
mov ecx, dword [0x9b6430]
mov dword [ebp - 0x40], ecx
mov edx, dword [0x9b642c]
mov dword [ebp - 8], edx
mov eax, dword [ebp - 0x10]
sub eax, dword [ebp - 0x40]
shr eax, 1
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x18]
sub ecx, dword [ebp - 8]
shr ecx, 1
mov dword [ebp - 0x1c], ecx
push 0
mov edx, dword [0x9b64b8]
push edx
push 0
push 0
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp - 0x40]
push ecx
mov edx, dword [ebp - 0x1c]
push edx
mov eax, dword [ebp - 0x14]
push eax
push 0x80000000
push 0x9b4680
push 0x9b46d0
push 0x88
call dword [0x9b4134]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
mov dword [0x9b6428], ecx
mov edx, dword [ebp - 0xc]
push edx
call dword [0x9b410c]
push eax
call fcn.009b0530
push 5
mov eax, dword [ebp - 0xc]
push eax
call dword [0x9b4148]
mov ecx, dword [ebp - 0xc]
push ecx
call dword [0x9b412c]
push 0x9b05c0
mov edx, dword [0x9b64cc]
mov eax, dword [edx + 0x34]
imul eax, eax, 0x3e8
push eax
push 0
push 0
call dword [0x9b413c]
mov dword [0x9b6434], eax
push 1
push 0
push 0
push 0
lea ecx, [ebp - 0x3c]
push ecx
call dword [0x9b4130]
test eax, eax
je 0x9b0737
cmp dword [ebp - 0x38], 0x12
jne 0x9b072b
mov dword [0x9b6444], 0
call fcn.009b0740
xor eax, eax
jmp 0x9b0737
lea edx, [ebp - 0x3c]
push edx
call dword [0x9b4140]
jmp 0x9b06fc
mov esp, ebp
pop ebp
ret 4

Function at 0x9b1b00
Capabilities:
Read .ini file
Read and send data from client to server
Send data
Send data on socket
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ebp
mov dword [ebp], 0
add ebp, 4
mov dword [ebp], 0
add ebp, 4
mov dword [ebp], 0
add ebp, 4
mov dword [ebp], 0
add ebp, 4
mov dword [ebp], 0
add ebp, 4
mov dword [ebp], 0
pop ebp
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x9b269c
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
pushal
mov esi, dword [esp + 0x24]
mov ecx, dword [esp + 0x28]
mov edi, 0x9b4168
sub eax, eax
test esi, esi
je 0x9b2774
sub eax, 1
test ecx, ecx
je 0x9b2772
test esi, 3
je 0x9b26da
xor al, byte [esi]
inc esi
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
dec ecx
jne 0x9b26bf
mov edx, ecx
and edx, 7
shr ecx, 3
je 0x9b2759
xor eax, dword [esi]
add esi, 4
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
xor eax, dword [esi]
add esi, 4
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
dec ecx
jne 0x9b26e4
mov ecx, edx
test ecx, ecx
je 0x9b2772
xor al, byte [esi]
inc esi
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
dec ecx
jne 0x9b275f
not eax
mov dword [esp + 0x1c], eax
popal
ret

Function at 0x9b277c
Capabilities:
Decompress data using aplib

Disassembly:
pushal
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x28]
cld
mov dl, 0x80
xor ebx, ebx
movsb byte es:[edi], byte [esi]
mov bl, 2
call fcn.009b27ff
jae 0x9b278a
xor ecx, ecx
call fcn.009b27ff
jae 0x9b27b9
xor eax, eax
call fcn.009b27ff
jae 0x9b27c9
mov bl, 2
inc ecx
mov al, 0x10
call fcn.009b27ff
adc al, al
jae 0x9b27ab
jne 0x9b27f5
stosb byte es:[edi], al
jmp 0x9b278d
call fcn.009b280b
sub ecx, ebx
jne 0x9b27d2
call fcn.009b2809
jmp 0x9b27f1
lodsb al, byte [esi]
shr eax, 1
je 0x9b281b
adc ecx, ecx
jmp 0x9b27ee
xchg ecx, eax
dec eax
shl eax, 8
lodsb al, byte [esi]
call fcn.009b2809
cmp eax, 0x7d00
jae 0x9b27ee
cmp ah, 5
jae 0x9b27ef
cmp eax, 0x7f
ja 0x9b27f0
inc ecx
inc ecx
xchg ebp, eax
mov eax, ebp
mov bl, 1
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x9b278d
sub edi, dword [esp + 0x28]
mov dword [esp + 0x1c], edi
popal
ret

Function at 0x9b314c
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x9b6000]
jne 0x9b3156
repz ret
jmp fcn.009b33fd
Function at 0x4201b0
Capabilities:
Encode data using xor

Disassembly:
mov dh, 0xc9
push ebx
sahf
lodsd eax, dword [esi]
adc cl, cl
aad 0xc7
hlt
and dword [edi - 0x50], edi
stc
add dword [edi - 0x66], ebx
adc ebp, esp
or dl, 0x85
nop
xchg dword [edi], esp
sub byte [ecx - 0x52439fab], dl
ja 0x42019b
add al, 0x25
mov ebp, 0x95f5233b
pop ebp
sub al, 0x14
inc ecx
div byte [edx]
clc
imul eax, ecx, 0xb54ac1b0
pop esp
lodsd eax, dword [esi]
inc ebp
push ebx
xor dword [ebx + 0x6704f54d], ebx
popfd
pop ss
xor byte [0x2f507cd], 0x44
mov bh, 0x55
lea eax, [edi + 0x4b]
dec ebp
rcl byte [ebp + 0x74a6073e]
dec ebx
push ss
in eax, 0xed
mov esi, 0xb4a55468
insb byte es:[edi], dx
daa
and eax, 0xf2ad8dfc
lodsd eax, dword [esi]
push edx
aaa
inc esp
push edi
jne 0x4201e8
and ah, dl
xor al, 0x85
cmpsd dword [esi], dword es:[edi]
shl byte [0x17c94a5c], 1
invalid

Function at 0x4457f8
Capabilities:
Encode data using xor

Disassembly:
sub dword [edx], ecx
mov ah, 0x76
and ax, 0x1a7f
xlatb
cmp cl, dh

Function at 0x4650a8
Capabilities:
Encode data using xor

Disassembly:
lds eax, [ebp - 0x393f21a1]
mov ebx, 0x606664b8
inc esp
and al, 0x42
pop ss
dec ebp
mov byte [edx + 0x2bca7a83], dh
mov edi, edi
test dword [esi - 0x52e59def], ebp
sub byte [ecx], cl
sub dword [eax - 0x1a1014a4], esi
pop eax
dec dword [ecx + 0x6fe4ead]
js 0x465115
pop edx
adc bh, byte [esi]
out dx, eax
sbb dword [edi], ecx
int1
mov esp, 0x16a63afb
sbb al, 0xeb
std
sahf
jmp 0x465140
retf 0x871c
jno 0x4650fe
dec edi
das
aad 0xf2
cmp byte [eax - 0x4ab08083], 0x98
cwde
invalid
or al, 0xe4
js 0x465121
xor ecx, dword [esi + 0x54bffe83]
dec edi
and byte [eax + ebp*8], bh
outsd dx, dword [esi]
ljmp 0xe726

Function at 0x48a9dc
Capabilities:
Encode data using xor

Disassembly:
test eax, 0xa3d9d0f2
jmp 0x48a9ea
dec ebp
inc edi
daa
bts dword [ebx - 0x78], esi
mov byte [ebx - 0x22], al
push eax
push edx
jns 0x48a9d1
mov bl, 0x28
adc al, 0x17
cmc
dec edx
cmp byte [ebx + edi*2 + 0x2d67b721], bl
jnp 0x48a9df
mov bh, 0x67
sub eax, 0x9b046497
wait
pop esp
insd dword es:[edi], dx
xor dh, byte [edx]
popfd
adc eax, 0x20e4f40b
in al, 0x20
push 0xacac8401
test byte [esp + ebp*4 - 0x4189b351], ch
scasd eax, dword es:[edi]
dec esp
jbe 0x48a996
push ebp
leave
clc
add byte [ecx], al
add esi, esp
stc
daa
loop 0x48a9a7
invalid
invalid

Function at 0x4a1a3c
Capabilities:
Encode data using xor

Disassembly:
and ah, byte [ebx]
dec esp
test al, 0x9e
xchg esi, eax
pop ebx
insb byte es:[edi], dx
sti
jmp 0x4a1a73
invalid
Function at 0x4ba3ed
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x4c23d8
cmp edx, dword [eax]
je 0x4ba40f
add eax, 8
inc ecx
cmp eax, 0x4c2468
jl 0x4ba400
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x4c23d8]
jne 0x4ba53d
mov eax, dword [0x4c6d5c]
cmp eax, 1
je 0x4ba517
test eax, eax
jne 0x4ba440
cmp dword [0x4c2300], 1
je 0x4ba517
cmp edx, 0xfc
je 0x4ba53d
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4ba477
lea eax, [ebp - 0x1a4]
push 0x4bf878
push eax
call fcn.004badd0
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.004bb260
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x4ba4ba
lea eax, [ebp - 0x1a4]
push eax
call fcn.004bb260
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x4bf874
push edi
call fcn.004bd130
add esp, 0x10
lea eax, [ebp - 0xa0]
push 0x4bf858
push eax
call fcn.004badd0
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.004bade0
lea eax, [ebp - 0xa0]
push 0x4bf854
push eax
call fcn.004bade0
push dword [esi + 0x4c23dc]
lea eax, [ebp - 0xa0]
push eax
call fcn.004bade0
push 0x12010
lea eax, [ebp - 0xa0]
push 0x4bf82c
push eax
call fcn.004bd0a4
add esp, 0x2c
pop edi
jmp 0x4ba53d
lea eax, [ebp + 8]
lea esi, [esi + 0x4c23dc]
push 0
push eax
push dword [esi]
call fcn.004bb260
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x3a287a35
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0x42c
mov eax, 0x3a28b1b0
call fcn.3a28a102
mov edi, ecx
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov dword [ebp - 0x420], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x41c], eax
call dword [0x3a28e770]
xor ebx, ebx
mov dword [ebp - 0x424], eax
mov dword [ebp - 0x428], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x430], edi
mov dword [ebp - 0x434], ebx
mov dword [ebp - 0x418], ebx
cmp esi, ebx
mov byte [ebp - 4], 1
je 0x3a287af5
push esi
call dword [sym.imp.kernel32.dll_lstrlenW]
inc eax
push 2
push eax
mov dword [ebp - 0x42c], eax
lea eax, [ebp - 0x42c]
push eax
call fcn.3a284e96
add esp, 0xc
test eax, eax
jl 0x3a287af5
mov edi, dword [ebp - 0x42c]
cmp edi, 0x400
jg 0x3a287ad7
push edi
call fcn.3a282e50
test al, al
pop ecx
je 0x3a287ad7
mov eax, edi
call fcn.3a28a1e1
mov dword [ebp - 0x10], esp
mov eax, esp
jmp 0x3a287ae3
push edi
lea ecx, [ebp - 0x428]
call fcn.3a284e96
push dword [ebp - 0x424]
push edi
push esi
push eax
call fcn.3a284e96
cmp eax, ebx
jne 0x3a287b2c
lea eax, [ebp - 0x414]
cmp dword [ebp - 0x418], eax
je 0x3a287b0e
lea ecx, [ebp - 0x418]
call fcn.3a284831
lea ecx, [ebp - 0x428]
call fcn.3a282d72
mov eax, 0x8007000e
lea esp, [ebp - 0x448]
call fcn.3a28a15b
ret 0x10
push 2
push ebx
push eax
call dword [sym.imp.kernel32.dll_LoadLibraryExA]
mov edi, eax
cmp edi, ebx
mov dword [ebp - 0x424], edi
jne 0x3a287b4e
call fcn.3a283f4e
mov esi, eax
jmp 0x3a287c4c
push dword [ebp - 0x41c]
push dword [ebp - 0x420]
push edi
call dword [sym.imp.kernel32.dll_FindResourceA]
mov esi, eax
cmp esi, ebx
jne 0x3a287b71
call fcn.3a283f4e
jmp 0x3a287c3e
push esi
push edi
call dword [sym.imp.kernel32.dll_LoadResource]
cmp eax, ebx
mov dword [ebp - 0x41c], eax
je 0x3a287b67
push esi
push edi
call dword [sym.imp.kernel32.dll_SizeofResource]
mov esi, eax
lea eax, [esi + 1]
cmp eax, esi
mov dword [ebp - 0x420], esi
jae 0x3a287bca
lea eax, [ebp - 0x414]
cmp dword [ebp - 0x418], eax
je 0x3a287bb3
lea ecx, [ebp - 0x418]
call fcn.3a284831
mov esi, 0x8007000e
lea ecx, [ebp - 0x428]
call fcn.3a282d72
mov eax, esi
jmp 0x3a287b1e
push eax
lea ecx, [ebp - 0x418]
mov byte [ebp - 4], 2
call fcn.3a284e96
mov dword [ebp - 4], 1
jmp 0x3a287bfc
cmp dword [ebp - 0x418], ebx
jne 0x3a287c0b
mov esi, 0x8007000e
jmp 0x3a287c40
push esi
push dword [ebp - 0x41c]
push esi
push dword [ebp - 0x418]
call fcn.3a284e96
mov eax, dword [ebp - 0x418]
add esp, 0x10
push dword [ebp + 0x14]
mov byte [eax + esi], bl
push dword [ebp - 0x418]
lea ecx, [ebp - 0x434]
call fcn.3a284e96
mov esi, eax
push dword [ebp - 0x424]
call dword [sym.imp.kernel32.dll_FreeLibrary]
lea eax, [ebp - 0x414]
cmp dword [ebp - 0x418], eax
je 0x3a287bb8
lea ecx, [ebp - 0x418]
call fcn.3a284831
jmp 0x3a287bb8
Function at 0x414288
Capabilities:
Parse pe header

Disassembly:
push 0x28
push 0x41da28
call fcn.0041417c
xor edi, edi
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
cmp word [eax], 0x5a4d
jne 0x4142c3
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4142c3
movzx eax, word [ecx + 0x18]
cmp eax, 0x10b
je 0x4142db
cmp eax, 0x20b
je 0x4142c8
mov dword [ebp - 0x1c], edi
jmp 0x4142ef
cmp dword [ecx + 0x84], 0xe
jbe 0x4142c3
xor eax, eax
cmp dword [ecx + 0xf8], edi
jmp 0x4142e9
cmp dword [ecx + 0x74], 0xe
jbe 0x4142c3
xor eax, eax
cmp dword [ecx + 0xe8], edi
setne al
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], edi
push 1
call dword [sym.imp.MSVCR71.dll___set_app_type]
pop ecx
or dword [0x422f58], 0xffffffff
or dword [0x422f5c], 0xffffffff
call dword [sym.imp.MSVCR71.dll___p__fmode]
mov ecx, dword [0x422e34]
mov dword [eax], ecx
call dword [sym.imp.MSVCR71.dll___p__commode]
mov ecx, dword [0x422e30]
mov dword [eax], ecx
mov eax, dword [sym.imp.MSVCR71.dll__adjust_fdiv]
mov eax, dword [eax]
mov dword [0x422f54], eax
call fcn.00414562
call fcn.00414602
cmp dword [0x422a70], edi
jne 0x41434f
push fcn.00414602
call dword [sym.imp.MSVCR71.dll___setusermatherr]
pop ecx
call fcn.004145f0
push 0x422044
push 0x422040
call sub.MSVCR71.dll__initterm
push 0x4145a6
call fcn.00414122
mov eax, dword [0x422e2c]
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x24]
push eax
push dword [0x422e28]
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.MSVCR71.dll___getmainargs]
add esp, 0x20
mov dword [ebp - 0x34], eax
cmp eax, edi
jge 0x4143a3
push 8
call sub.MSVCR71.dll__amsg_exit
pop ecx
push 0x42203c
push section..data
call sub.MSVCR71.dll__initterm
call dword [sym.imp.MSVCR71.dll___p___initenv]
mov ecx, dword [ebp - 0x20]
mov dword [eax], ecx
push dword [ebp - 0x20]
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
call fcn.00407102
add esp, 0x14
mov esi, eax
mov dword [ebp - 0x38], esi
cmp dword [ebp - 0x1c], edi
jne 0x4143df
push esi
call dword [sym.imp.MSVCR71.dll_exit]
call dword [sym.imp.MSVCR71.dll__cexit]
jmp 0x414414
or dword [ebp - 4], 0xffffffff
mov eax, esi
call fcn.004141b7
ret
Function at 0x4c5e50
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x7a000]
push edi
or ebp, 0xffffffff
jmp 0x4c5e72
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x4c5e79
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4c5e68
mov eax, 1
add ebx, ebx
jne 0x4c5e8b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x4c5e9c
jne 0x4c5ebb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4c5ebb
dec eax
add ebx, ebx
jne 0x4c5ea8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x4c5e80
add ebx, ebx
jne 0x4c5eb7
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x4c5f0d
xor ecx, ecx
sub eax, 3
jb 0x4c5ed3
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x4c5f42
sar eax, 1
mov ebp, eax
jmp 0x4c5ede
add ebx, ebx
jne 0x4c5ede
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4c5eac
inc ecx
add ebx, ebx
jne 0x4c5eec
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4c5eac
add ebx, ebx
jne 0x4c5ef9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x4c5eee
jne 0x4c5f0a
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4c5eee
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x4c5f2c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x4c5f1e
jmp 0x4c5e6e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x4c5f2c
add edi, ecx
jmp 0x4c5e6e
pop esi
mov edi, esi
mov ecx, 0x38f2
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x4c5f4a
cmp byte [edi], 0x1b
jne 0x4c5f4a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x4c5f4f
lea edi, [esi + 0xc1000]
mov eax, dword [edi]
or eax, eax
je 0x4c5fc7
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xcaddc]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xcaf30]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x4c5f7c
mov ecx, edi
jns 0x4c5fab
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xcaf34]
or eax, eax
je 0x4c5fc1
mov dword [ebx], eax
add ebx, 4
jmp 0x4c5f99
call dword [esi + 0xcaf44]
mov ebp, dword [esi + 0xcaf38]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x227]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x4c5ffb
sub esp, 0xffffff80
jmp 0x4176dc