joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100214f0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x20
cmp byte [edx + 0x1199], 0
mov edi, edx
mov esi, ecx
je 0x10021541
mov edx, edi
mov ecx, esp
push 3
push 0
call fcn.100217e0
add esp, 8
movq xmm0, qword [esp]
mov eax, dword [esp + 0xc]
mov edx, dword [esp + 8]
movd ecx, xmm0
test ecx, ecx
je 0x1002160d
movq qword [esi], xmm0
mov dword [esi + 8], edx
mov dword [esi + 0xc], eax
jmp 0x10021640
cmp byte [edi + 0x119a], 0
je 0x10021648
mov dword [esp + 0x14], esi
mov byte [edi + 0x1194], 0xc
xor edi, edi
lea esi, [0x507f8a1]
lea edx, [0x507f8a2]
mov eax, 0xfffffff9
mov dword [esp + 0x18], 0
nop word cs:[eax + eax]
nop
movzx ebx, byte [esi]
mov esi, edx
mov edx, ebx
add dl, 0xd0
cmp dl, 0xa
jb 0x100215a5
or bl, 0x20
mov edx, ebx
add dl, 0x9f
cmp dl, 6
jae 0x1002169d
add bl, 0xa9
mov edx, ebx
mov ecx, edi
movzx ebx, dl
lea edx, [esi + 1]
shl ecx, 4
or ebx, ecx
test eax, eax
cmove edx, esi
je 0x100215c6
shld dword [esp + 0x18], edi, 4
inc eax
test esi, esi
mov edi, ebx
jne 0x10021580
mov ecx, 0x507f69e
mov edx, 9
xor ebx, 0xe
call fcn.100091f0
mov edi, eax
test eax, eax
mov esi, 1
mov ecx, 0x507f68c
mov edx, 0x12
cmove edi, esi
call fcn.100091f0
mov ecx, dword [esp + 0x14]
test eax, eax
cmove eax, esi
mov dword [ecx], edi
mov dword [ecx + 4], eax
mov dword [ecx + 8], ebx
mov dword [ecx + 0xc], 0
jmp 0x10021640
movzx ecx, byte [edi + 0x118f]
cmp ecx, 0x10
jae 0x10021689
mov dword [edi + ecx*8], edx
mov dword [edi + ecx*8 + 4], eax
mov dword [esi], 0
mov eax, dword [edi + 0x1178]
add dword [edi + 0xa0], eax
adc dword [edi + 0xa4], 0
mov byte [edi + 0x1194], 0xd
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov edx, edi
mov ecx, esp
push 2
push 0
call fcn.100217e0
add esp, 8
movq xmm0, qword [esp]
mov eax, dword [esp + 0xc]
mov edx, dword [esp + 8]
movd ecx, xmm0
test ecx, ecx
jne 0x10021532
movzx ecx, byte [edi + 0x118f]
cmp ecx, 0x10
jb 0x10021619
mov edx, 0x10
push 0x507f8ac
jmp 0x10021693
mov edx, 0x10
push 0x507f8bc
call fcn.10004a00
add esp, 4
ud2
mov ecx, 0x50851ac
mov edx, 0xe
push 0x507ed4c
call fcn.100053c0
add esp, 4
ud2
Function at 0x10025b10
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x20
cmp byte [edx + 0x118e], 3
mov edi, edx
mov esi, ecx
jne 0x10025b6a
movzx ecx, byte [edi + 0x1190]
cmp ecx, 0x10
jae 0x10025c62
movzx eax, byte [edi + 0xa8]
mov dword [esi], 0
and al, 1
mov byte [edi + ecx*8], al
mov eax, dword [edi + 0x1178]
add dword [edi + 0xa0], eax
adc dword [edi + 0xa4], 0
mov byte [edi + 0x1194], 0xd
jmp 0x10025c5a
lea ecx, [esp + 8]
mov edx, edi
push 0
push 0
call fcn.100217e0
add esp, 8
movq xmm0, qword [esp + 8]
movd eax, xmm0
test eax, eax
je 0x10025ba1
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
movq qword [esi], xmm0
mov dword [esi + 8], ecx
mov dword [esi + 0xc], eax
jmp 0x10025c5a
mov dword [esp], esi
mov byte [edi + 0x1194], 0xc
xor edi, edi
lea esi, [0x507f865]
lea edx, [0x507f866]
mov eax, 0xfffffff9
mov dword [esp + 4], 0
nop word cs:[eax + eax]
movzx ebx, byte [esi]
mov esi, edx
mov edx, ebx
add dl, 0xd0
cmp dl, 0xa
jb 0x10025bf5
or bl, 0x20
mov edx, ebx
add dl, 0x9f
cmp dl, 6
jae 0x10025c76
add bl, 0xa9
mov edx, ebx
mov ecx, edi
movzx ebx, dl
lea edx, [esi + 1]
shl ecx, 4
or ebx, ecx
test eax, eax
cmove edx, esi
je 0x10025c16
shld dword [esp + 4], edi, 4
inc eax
test esi, esi
mov edi, ebx
jne 0x10025bd0
mov ecx, 0x507f69e
mov edx, 9
xor ebx, 0x1a
call fcn.100091f0
mov edi, eax
test eax, eax
mov esi, 1
mov ecx, 0x507f68c
mov edx, 0x12
cmove edi, esi
call fcn.100091f0
mov ecx, dword [esp]
test eax, eax
cmove eax, esi
mov dword [ecx], edi
mov dword [ecx + 4], eax
mov dword [ecx + 8], ebx
mov dword [ecx + 0xc], 0
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov edx, 0x10
push 0x507f890
call fcn.10004a00
add esp, 4
ud2
mov ecx, 0x50851ac
mov edx, 0xe
push 0x507ed4c
call fcn.100053c0
add esp, 4
ud2
Function at 0x10034550
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x1c
mov eax, dword [ebp + 0x14]
movzx esi, byte [ebp + 0x18]
mov edi, ecx
mov ecx, dword [ebp + 0x10]
or eax, dword [ebp + 8]
or esi, edx
mov edx, dword [ebp + 0xc]
and ecx, 0xfffff000
or esi, ecx
lea ecx, [ebp - 0x28]
push eax
push esi
call fcn.10030320
add esp, 8
mov eax, dword [ebp - 0x28]
test eax, eax
je 0x100345a2
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x24]
mov esi, dword [ebp - 0x20]
mov dword [edi], eax
mov dword [edi + 4], edx
mov dword [edi + 0xc], ecx
mov dword [edi + 8], esi
jmp 0x10034679
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x10], edi
xor edi, edi
lea esi, [0x5083069]
mov ecx, 0xfffffff9
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], eax
lea eax, [0x508306a]
nop word cs:[eax + eax]
nop
movzx ebx, byte [esi]
mov esi, eax
mov eax, ebx
add al, 0xd0
cmp al, 0xa
jb 0x100345f1
or bl, 0x20
mov eax, ebx
add al, 0x9f
cmp al, 6
jae 0x10034681
add bl, 0xa9
mov eax, ebx
mov edx, edi
movzx ebx, al
lea eax, [esi + 1]
shl edx, 4
or ebx, edx
test ecx, ecx
cmove eax, esi
je 0x10034611
shld dword [ebp - 0x18], edi, 4
inc ecx
test esi, esi
mov edi, ebx
jne 0x100345d0
mov ecx, dword [ebp - 0x14]
test ecx, ecx
je 0x10034632
mov eax, dword [ebp + 0x10]
mov edx, dword [ebp - 0x10]
and eax, 0xfff
movzx eax, byte [ecx + eax]
mov byte [edx + 4], al
mov dword [edx], 0
jmp 0x10034679
mov ecx, 0x5086869
mov edx, 0x13
xor ebx, 0x2c7
call fcn.100091f0
mov ecx, 0x5086845
mov edx, 6
mov edi, eax
call fcn.100091f0
mov edx, dword [ebp - 0x10]
test eax, eax
mov ecx, 1
cmove eax, ecx
test edi, edi
cmove edi, ecx
mov dword [edx], edi
mov dword [edx + 4], eax
mov dword [edx + 8], ebx
mov dword [edx + 0xc], 0
add esp, 0x1c
pop esi
pop edi
pop ebx
pop ebp
ret
mov ecx, 0x50851ac
mov edx, 0xe
push 0x507ed4c
call fcn.100053c0
add esp, 4
ud2
Function at 0x14f81270
Capabilities:
Accept command line arguments

Disassembly:
mov eax, dword [esp + 8]
cmp eax, 1
jne 0x14f81334
call dword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [0x14fa126c], eax
call fcn.14f82440
test eax, eax
jne 0x14f81294
ret 0xc
mov ecx, dword [0x14fa126c]
xor edx, edx
mov eax, ecx
mov dl, ch
and eax, 0xff
mov dword [0x14fa1278], edx
mov dword [0x14fa1274], eax
shl eax, 8
add eax, edx
shr ecx, 0x10
mov dword [0x14fa1270], eax
mov dword [0x14fa126c], ecx
call fcn.14f815e0
test eax, eax
jne 0x14f812d6
call fcn.14f82480
xor eax, eax
ret 0xc
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [0x14ff8950], eax
call fcn.14f822e0
mov ecx, dword [0x14ff8950]
mov dword [0x14fa1258], eax
test ecx, ecx
je 0x14f81325
test eax, eax
je 0x14f81325
call 0x15000e60
call fcn.14f822d0
call 0x15000e60
call fcn.14f81a30
call fcn.14f81480
mov eax, dword [0x14fa1254]
inc eax
mov dword [0x14fa1254], eax
mov eax, 1
ret 0xc
call fcn.14f81640
call fcn.14f82480
xor eax, eax
ret 0xc
test eax, eax
jne 0x14f81374
mov eax, dword [0x14fa1254]
test eax, eax
jle 0x14f8136f
mov ecx, eax
mov eax, dword [0x14fa12a4]
dec ecx
test eax, eax
mov dword [0x14fa1254], ecx
jne 0x14f81358
call fcn.14f814d0
call fcn.14f819d0
call fcn.14f81640
call fcn.14f82480
mov eax, 1
ret 0xc
xor eax, eax
ret 0xc
cmp eax, 3
jne 0x14f81383
push 0
call fcn.14f81710
add esp, 4
mov eax, 1
ret 0xc

Function at 0x14f814e0
Capabilities:
Terminate process

Disassembly:
push ebx
push ebp
push esi
call fcn.14f815a0
mov eax, dword [0x14fa12a8]
mov ebp, dword [esp + 0x10]
cmp eax, 1
jne 0x14f81504
push ebp
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov eax, dword [esp + 0x14]
mov ebx, dword [esp + 0x18]
test eax, eax
mov dword [0x14fa12a4], 1
mov byte [0x14fa12a0], bl
jne 0x14f8155e
mov ecx, dword [0x14ff8948]
test ecx, ecx
je 0x14f8154c
mov esi, dword [0x14ff8944]
sub esi, 4
cmp esi, ecx
jb 0x14f8154c
mov eax, dword [esi]
test eax, eax
je 0x14f81545
call eax
mov ecx, dword [0x14ff8948]
sub esi, 4
cmp esi, ecx
jae 0x14f81537
push 0x14f8901c
push 0x14f89014
call fcn.14f815c0
add esp, 8
push 0x14f89024
push 0x14f89020
call fcn.14f815c0
add esp, 8
test ebx, ebx
je 0x14f8157d
call fcn.14f815b0
pop esi
pop ebp
pop ebx
ret
push ebp
mov dword [0x14fa12a8], 1
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x14f815e0
Capabilities:
Allocate thread local storage
Set thread local storage value

Disassembly:
push esi
call fcn.14f826e0
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
mov dword [0x14f8a884], eax
je 0x14f81638
push 0x74
push 1
call fcn.14f82910
mov esi, eax
add esp, 8
test esi, esi
je 0x14f81638
mov eax, dword [0x14f8a884]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
je 0x14f81638
push esi
call fcn.14f81670
add esp, 4
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [esi], eax
mov dword [esi + 4], 0xffffffff
mov eax, 1
pop esi
ret
xor eax, eax
pop esi
ret
Function at 0x14f81690
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov eax, dword [0x14f8a884]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
test esi, esi
jne 0x14f816fe
push 0x74
push 1
call fcn.14f82910
mov esi, eax
add esp, 8
test esi, esi
je 0x14f816f4
mov ecx, dword [0x14f8a884]
push esi
push ecx
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
je 0x14f816f4
push esi
call fcn.14f81670
add esp, 4
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push edi
mov dword [esi], eax
mov dword [esi + 4], 0xffffffff
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, esi
pop edi
pop esi
ret
push 0x10
call fcn.14f81440
add esp, 4
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, esi
pop edi
pop esi
ret

Function at 0x14f81710
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
mov eax, dword [0x14f8a884]
cmp eax, 0xffffffff
je 0x14f817bf
push esi
mov esi, dword [esp + 8]
test esi, esi
jne 0x14f81734
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
test esi, esi
je 0x14f817b0
mov eax, dword [esi + 0x24]
test eax, eax
je 0x14f81744
push eax
call fcn.14f829c0
add esp, 4
mov eax, dword [esi + 0x28]
test eax, eax
je 0x14f81754
push eax
call fcn.14f829c0
add esp, 4
mov eax, dword [esi + 0x30]
test eax, eax
je 0x14f81764
push eax
call fcn.14f829c0
add esp, 4
mov eax, dword [esi + 0x38]
test eax, eax
je 0x14f81774
push eax
call fcn.14f829c0
add esp, 4
mov eax, dword [esi + 0x40]
test eax, eax
je 0x14f81784
push eax
call fcn.14f829c0
add esp, 4
mov eax, dword [esi + 0x44]
test eax, eax
je 0x14f81794
push eax
call fcn.14f829c0
add esp, 4
mov eax, dword [esi + 0x50]
cmp eax, 0x14f8ab00
je 0x14f817a7
push eax
call fcn.14f829c0
add esp, 4
push esi
call fcn.14f829c0
add esp, 4
mov eax, dword [0x14f8a884]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
pop esi
ret
Function at 0x14f822e0
Capabilities:
Query environment variable

Disassembly:
mov eax, dword [0x14fa15dc]
push ebx
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_GetEnvironmentStrings]
push esi
xor esi, esi
xor ebx, ebx
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
test eax, eax
jne 0x14f82322
call edi
mov esi, eax
test esi, esi
je 0x14f8230c
mov eax, 1
jmp 0x14f8231d
call ebp
mov ebx, eax
test ebx, ebx
je 0x14f8242f
mov eax, 2
mov dword [0x14fa15dc], eax
cmp eax, 1
jne 0x14f823c2
test esi, esi
jne 0x14f8233b
call edi
mov esi, eax
test esi, esi
je 0x14f8242f
cmp word [esi], 0
mov eax, esi
je 0x14f82355
add eax, 2
cmp word [eax], 0
jne 0x14f82343
add eax, 2
cmp word [eax], 0
jne 0x14f82343
sub eax, esi
push 0
sar eax, 1
inc eax
push 0
mov ebp, eax
push 0
push 0
push ebp
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov edi, eax
test edi, edi
je 0x14f823b4
push edi
call fcn.14f82a30
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x14f823b4
push 0
push 0
push edi
push ebx
push ebp
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
jne 0x14f823a6
push ebx
call fcn.14f829c0
add esp, 4
xor ebx, ebx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop esi
pop ebp
pop ebx
ret
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
ret
cmp eax, 2
jne 0x14f8242f
test ebx, ebx
jne 0x14f823d3
call ebp
mov ebx, eax
test ebx, ebx
je 0x14f8242f
mov cl, byte [ebx]
mov eax, ebx
test cl, cl
je 0x14f823eb
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x14f823db
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x14f823db
sub eax, ebx
inc eax
mov esi, eax
push esi
call fcn.14f82a30
mov ebp, eax
add esp, 4
test ebp, ebp
jne 0x14f8240d
push ebx
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
ret
mov ecx, esi
mov esi, ebx
mov eax, ecx
mov edi, ebp
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
push ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
mov eax, ebp
pop edi
pop esi
pop ebp
pop ebx
ret
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
Function at 0x14f82500
Capabilities:
Write file on windows

Disassembly:
mov ecx, dword [esp + 4]
sub esp, 0x1a8
mov eax, 0x14f8a9b0
push ebx
push ebp
push esi
push edi
xor ebp, ebp
cmp ecx, dword [eax]
je 0x14f82524
add eax, 8
inc ebp
cmp eax, 0x14f8aa40
jb 0x14f82515
cmp ecx, dword [ebp*8 + 0x14f8a9b0]
jne 0x14f826cb
mov eax, dword [0x14fa1260]
cmp eax, 1
je 0x14f8268d
test eax, eax
jne 0x14f82550
cmp dword [0x14fa1264], 1
je 0x14f8268d
cmp ecx, 0xfc
je 0x14f826cb
lea eax, [esp + 0xb4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x14f8258b
mov ecx, 5
mov esi, str._program_name_unknown_
lea edi, [esp + 0xb4]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
lea edi, [esp + 0xb4]
or ecx, 0xffffffff
xor eax, eax
lea ebx, [esp + 0xb4]
repne scasb al, byte es:[edi]
not ecx
cmp ecx, 0x3c
jbe 0x14f825d4
lea edi, [esp + 0xb4]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
push 3
mov ebx, ecx
lea ecx, [esp + 0xb8]
sub ecx, 0x3b
push 0x14f88728
add ebx, ecx
push ebx
call fcn.14f83650
add esp, 0xc
mov ecx, 6
mov esi, str.Runtime_Error__n_nProgram:
lea edi, [esp + 0x14]
xor eax, eax
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
or ecx, 0xffffffff
mov edi, ebx
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x14]
mov ebx, ecx
mov esi, edi
or ecx, 0xffffffff
mov edi, edx
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea edx, [esp + 0x14]
and ecx, 3
push 0x12010
rep movsb byte es:[edi], byte [esi]
mov edi, 0x14f88708
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push str.Microsoft_Visual_C_Runtime_Library
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea edx, [esp + 0x1c]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, dword [ebp*8 + 0x14f8a9b4]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea eax, [esp + 0x1c]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call fcn.14f835c0
add esp, 0xc
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1a8
ret
mov eax, dword [0x14ff8840]
test eax, eax
je 0x14f8269e
mov esi, dword [eax + 0x48]
cmp esi, 0xffffffff
jne 0x14f826a8
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov esi, eax
mov edx, dword [ebp*8 + 0x14f8a9b4]
lea ecx, [esp + 0x10]
push 0
push ecx
mov edi, edx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push edx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1a8
ret
Function at 0x14f83f80
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x41c
push ebx
mov ebx, dword [esp + 0x42c]
push ebp
xor ebp, ebp
push esi
cmp ebx, ebp
push edi
mov dword [esp + 0x10], ebp
mov dword [esp + 0x20], ebp
jne 0x14f83fac
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x41c
ret
mov ecx, dword [esp + 0x430]
mov eax, ecx
sar eax, 5
lea edi, [eax*4 + 0x14ff8840]
mov eax, ecx
and eax, 0x1f
mov dword [esp + 0x24], edi
mov edx, dword [edi]
lea esi, [eax + eax*8]
shl esi, 2
mov dword [esp + 0x14], esi
test byte [esi + edx + 4], 0x20
je 0x14f83fe7
push 2
push ebp
push ecx
call fcn.14f84500
add esp, 0xc
mov eax, dword [edi]
add eax, esi
test byte [eax + 4], 0x80
je 0x14f84149
mov ebp, dword [esp + 0x434]
mov dword [esp + 0x18], 0
test ebx, ebx
mov edi, ebp
jbe 0x14f84091
lea eax, [esp + 0x28]
mov ecx, edi
sub ecx, ebp
cmp ecx, ebx
jae 0x14f84042
mov cl, byte [edi]
inc edi
cmp cl, 0xa
jne 0x14f8402f
mov esi, dword [esp + 0x20]
mov byte [eax], 0xd
inc esi
inc eax
mov dword [esp + 0x20], esi
mov byte [eax], cl
inc eax
mov edx, eax
lea ecx, [esp + 0x28]
sub edx, ecx
cmp edx, 0x400
jl 0x14f84012
mov esi, eax
lea edx, [esp + 0x28]
lea eax, [esp + 0x1c]
sub esi, edx
mov edx, dword [esp + 0x24]
push 0
push eax
lea ecx, [esp + 0x30]
mov eax, dword [edx]
push esi
push ecx
mov ecx, dword [esp + 0x24]
mov edx, dword [ecx + eax]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x14f8413a
mov eax, dword [esp + 0x1c]
mov edx, dword [esp + 0x10]
add edx, eax
cmp eax, esi
mov dword [esp + 0x10], edx
jl 0x14f8408d
mov eax, edi
sub eax, ebp
cmp eax, ebx
jb 0x14f8400e
mov esi, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
test eax, eax
jne 0x14f84129
mov eax, dword [esp + 0x18]
test eax, eax
je 0x14f840e5
cmp eax, 5
jne 0x14f840ce
call fcn.14f844e0
mov dword [eax], 9
call fcn.14f844f0
mov dword [eax], 5
or eax, 0xffffffff
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x41c
ret
push eax
call fcn.14f84460
add esp, 4
or eax, 0xffffffff
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x41c
ret
mov ecx, dword [esp + 0x24]
mov edx, dword [ecx]
test byte [esi + edx + 4], 0x40
je 0x14f84105
cmp byte [ebp], 0x1a
jne 0x14f84105
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x41c
ret
call fcn.14f844e0
mov dword [eax], 0x1c
call fcn.14f844f0
mov dword [eax], 0
or eax, 0xffffffff
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x41c
ret
mov ecx, dword [esp + 0x20]
pop edi
pop esi
pop ebp
sub eax, ecx
pop ebx
add esp, 0x41c
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 0x18], eax
jmp 0x14f8408d
mov edx, dword [eax]
lea ecx, [esp + 0x1c]
push ebp
mov ebp, dword [esp + 0x438]
push ecx
push ebx
push ebp
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x14f8417a
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x18], 0
mov dword [esp + 0x10], eax
jmp 0x14f84091
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 0x18], eax
jmp 0x14f84091
Function at 0x41bc90
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x13000]
push edi
or ebp, 0xffffffff
jmp 0x41bcb2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x41bcb9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x41bca8
mov eax, 1
add ebx, ebx
jne 0x41bccb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x41bcc0
jne 0x41bcdc
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x41bcc0
xor ecx, ecx
sub eax, 3
jb 0x41bcf0
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x41bd62
mov ebp, eax
add ebx, ebx
jne 0x41bcfb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x41bd08
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x41bd2c
inc ecx
add ebx, ebx
jne 0x41bd18
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x41bd0d
jne 0x41bd29
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x41bd0d
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x41bd4c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x41bd3d
jmp 0x41bcae
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x41bd4c
add edi, ecx
jmp 0x41bcae
pop esi
mov edi, esi
mov ecx, 0xfa
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x41bd6a
cmp byte [edi], 5
jne 0x41bd6a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x41bd6f
lea edi, [esi + 0x19000]
mov eax, dword [edi]
or eax, eax
je 0x41bdde
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x1b43c]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x1b4c8]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x41bd9c
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x1b4cc]
or eax, eax
je 0x41bdd8
mov dword [ebx], eax
add ebx, 4
jmp 0x41bdb9
call dword [esi + 0x1b4d0]
popal
jmp 0x401089
Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
push 4
nop
nop
nop
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
cmp eax, 0
nop
nop
nop
je 0x433072
nop
nop
mov ebx, 0x40de38
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
push eax
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
div edi
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x565147b6
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
loop 0x433060
nop
nop
nop
nop
mov eax, section..data
nop
nop
cmp eax, 0
nop
je 0x4330d2
nop
nop
nop
nop
nop
mov ebx, 0x4304d8
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x77986b1c
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x4330c0
nop
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x431219
Function at 0x10011c00
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
push ebx
push esi
push edi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
movzx ebx, word [ecx + 6]
add eax, 0x18
add eax, ecx
test ebx, ebx
je 0x10011c3e
mov edi, dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
cmp edi, esi
jb 0x10011c36
mov ecx, dword [eax + 8]
add ecx, esi
cmp edi, ecx
jb 0x10011c40
inc edx
add eax, 0x28
cmp edx, ebx
jb 0x10011c26
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x10011d10
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
je 0x10011d26
xor eax, eax
pop ebp
ret
mov ecx, dword [eax + 0x3c]
add ecx, eax
xor eax, eax
cmp dword [ecx], 0x4550
jne 0x10011d41
mov edx, 0x10b
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret

Function at 0x1001c2dc
Capabilities:
Encode data using xor

Disassembly:
call 0x1001c255
sub bl, byte [ebx]
mov eax, 0x64f7f691
int 0x82
xchg ebx, eax
ror cl, 1
into
out dx, eax
cld
test edx, ebx
or eax, dword [ebx - 0x178f73c]
xor esi, 0xde5af04
add eax, esi
lea esp, [esp - 0xe]
mov esi, dword [esp + 0xe]
lea esp, [esp + 0x12]
xor esi, dword [esp]
push eax
sub eax, 0xf24f2b00
mov eax, esp
or dword [eax - 0x22], ebx
pop eax
jmp 0x1001c285
xor dword [esp], esi
xor eax, 0
mov dword [esp], esi
add esp, 4
add esi, dword [ebp + 8]
push ebp
add ebp, 0xc
mov ecx, dword [ebp]
pop ebp
ja 0x1001c2a1
xor edx, 0
jmp 0x1001c2ac
xor edx, edx
jmp 0x1001c2c3
jmp 0x1001c2cf
xor eax, eax
push 0x8427d7c0
call 0x1001c2dc
stc
add esp, 8
add esi, 0
cmp ecx, 0
je 0x1001c318
mov ebx, dword [ebp + 0x10]
mov edi, dword [ebp + 0x14]
add bl, dl
xor byte [esi], bl
mov dl, byte [esi]
inc esi
add ebx, edi
rol ebx, 8
dec ecx
jne 0x1001c2f1
lea esp, [esp - 4]
xchg dword [esp], ebx
mov ebx, dword [esp]
or eax, edx
xor eax, eax
add eax, dword [esp]
add esp, 4
pop esi
pop edi
pop ebx
xchg dword [esp], ecx
mov dword [esp], ecx
lea esp, [esp + 4]
pop edx
leave
je 0x1001c32f
add eax, 0
jno 0x1001c334
add esi, 0
ret 0x10