joyce8/EMBER2024-capa huggingface dataset:
Function at 0x585210
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push edi
push esi
mov eax, dword [0x69b7f4]
mov esi, ecx
test eax, eax
je 0x585236
dec eax
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 2
jb 0x58524f
cmp byte [eax + 4], 0
je 0x58524f
add eax, 5
pop esi
pop edi
ret
push 0x69b7f4
call fcn.0059fef0
add esp, 4
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 2
jae 0x58522a
mov eax, dword [0x69b7f4]
test eax, eax
je 0x5852c2
dec eax
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
je 0x5852db
mov edi, eax
test eax, eax
jne 0x5852a0
movzx eax, byte [0x69b8b9]
push 4
push 8
call fcn.00407070
add esp, 8
test eax, eax
je 0x5852ef
mov dword [eax], 0x69b7f4
mov byte [eax + 4], 0
mov edi, eax
mov eax, dword [0x69b7f4]
test eax, eax
je 0x5852e0
dec eax
push edi
push eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
xor ecx, ecx
test esi, esi
je 0x5852b5
cmp byte [esi], 0
mov byte [esi], 0
movzx eax, byte [esi + 1]
cmove eax, ecx
mov ecx, eax
lea eax, [edi + 5]
mov byte [edi + 4], 1
mov byte [edi + 5], cl
pop esi
pop edi
ret
push 0x69b7f4
call fcn.0059fef0
add esp, 4
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
jne 0x585265
xor eax, eax
pop esi
pop edi
ret
push 0x69b7f4
call fcn.0059fef0
add esp, 4
jmp 0x585298
push 8
push 4
call fcn.005a08c0
add esp, 8
ud2

Function at 0x585300
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push edi
push esi
sub esp, 8
mov eax, dword [0x69b804]
mov esi, ecx
test eax, eax
je 0x5853da
dec eax
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 2
jb 0x58532d
cmp dword [eax + 4], 0
mov edi, eax
jne 0x5853d5
mov eax, dword [0x69b804]
test eax, eax
je 0x5853fc
dec eax
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
je 0x585419
mov edi, eax
test eax, eax
jne 0x585391
movzx eax, byte [0x69b8b9]
push 4
push 0xc
call fcn.00407070
add esp, 8
test eax, eax
je 0x585435
mov dword [eax], 0x69b804
mov dword [eax + 4], 0
mov edi, eax
mov eax, dword [0x69b804]
test eax, eax
je 0x585423
dec eax
push edi
push eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
test esi, esi
je 0x5853a6
mov eax, dword [esi]
mov dword [esi], 0
test eax, eax
je 0x5853a8
mov eax, dword [esi + 4]
jmp 0x5853a8
xor eax, eax
mov edx, dword [edi + 4]
mov ecx, dword [edi + 8]
test edx, edx
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [edi + 4], 1
mov dword [edi + 8], eax
je 0x5853d5
test ecx, ecx
je 0x5853d5
lock dec dword [ecx]
jne 0x5853d5
lea ecx, [esp + 4]
call fcn.005779f0
add edi, 8
jmp 0x58541b
push 0x69b804
call fcn.0059fef0
add esp, 4
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 2
jae 0x585321
jmp 0x58532d
push 0x69b804
call fcn.0059fef0
add esp, 4
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
jne 0x58534b
xor edi, edi
mov eax, edi
add esp, 8
pop esi
pop edi
ret
push 0x69b804
call fcn.0059fef0
add esp, 4
jmp 0x585389
push 0xc
push 4
call fcn.005a08c0
add esp, 8
ud2
Function at 0x585450
Capabilities:
Generate random numbers via winapi
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push esi
and esp, 0xfffffff0
sub esp, 0x30
mov eax, dword [0x69b814]
test eax, eax
je 0x58554f
dec eax
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 2
jb 0x585481
mov esi, eax
mov eax, dword [eax]
or eax, dword [esi + 4]
jne 0x58554a
mov eax, dword [0x69b814]
test eax, eax
je 0x585571
dec eax
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
je 0x58558e
mov esi, eax
test eax, eax
jne 0x5854ec
movzx eax, byte [0x69b8b9]
push 8
push 0x20
call fcn.00407070
add esp, 8
test eax, eax
je 0x5855aa
mov dword [eax + 4], 0
mov dword [eax], 0
mov dword [eax + 0x18], 0x69b814
mov esi, eax
mov eax, dword [0x69b814]
test eax, eax
je 0x585598
dec eax
push esi
push eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
mov eax, dword [ebp + 8]
test eax, eax
je 0x58550b
mov ecx, dword [eax]
movups xmm0, xmmword [eax + 8]
mov dword [eax + 4], 0
mov dword [eax], 0
cmp ecx, 1
je 0x585539
xorps xmm0, xmm0
mov eax, esp
movaps xmmword [esp], xmm0
push 2
push 0x10
push eax
push 0
call dword [sym.imp.bcrypt.dll_BCryptGenRandom]
test eax, eax
js 0x58552b
movaps xmm0, xmmword [esp]
jmp 0x585539
lea ecx, [esp + 0x10]
call fcn.00582420
movups xmm0, xmmword [esp + 0x10]
mov dword [esi + 4], 0
mov dword [esi], 1
movups xmmword [esi + 8], xmm0
add esi, 8
jmp 0x585590
push 0x69b814
call fcn.0059fef0
add esp, 4
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 2
jae 0x585474
jmp 0x585481
push 0x69b814
call fcn.0059fef0
add esp, 4
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
jne 0x58549f
xor esi, esi
mov eax, esi
lea esp, [ebp - 4]
pop esi
pop ebp
ret
push 0x69b814
call fcn.0059fef0
add esp, 4
jmp 0x5854e4
push 0x20
push 8
call fcn.005a08c0
add esp, 8
ud2
Function at 0x5974d0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
mov eax, dword [esp + 0x14]
test eax, eax
je 0x597528
mov esi, dword [esp + 0x18]
lea edi, [edx + eax*2]
xor ebx, ebx
movzx eax, byte [edx + 1]
cmp byte [edx], ch
lea edx, [edx + 2]
lea ebp, [ebx + eax]
jne 0x597520
cmp ebx, ebp
ja 0x5975a2
cmp ebp, dword [esp + 0x1c]
ja 0x5975b3
add ebx, esi
nop word [eax + eax]
test eax, eax
je 0x597522
dec eax
cmp byte [ebx], cl
lea ebx, [ebx + 1]
jne 0x597510
jmp 0x59757f
ja 0x597528
cmp edx, edi
mov ebx, ebp
jne 0x5974e5
mov edx, dword [esp + 0x24]
test edx, edx
je 0x597583
mov esi, dword [esp + 0x20]
movzx ecx, cx
mov al, 1
add edx, esi
nop dword [eax + eax]
movzx ebx, byte [esi]
lea edi, [esi + 1]
test bl, bl
js 0x597560
mov esi, edi
sub ecx, ebx
jns 0x597577
jmp 0x597585
cmp edi, edx
je 0x59758c
movzx edi, byte [esi + 1]
and ebx, 0x7f
add esi, 2
shl ebx, 8
or ebx, edi
sub ecx, ebx
js 0x597585
xor al, 1
cmp esi, edx
jne 0x597540
jmp 0x597585
xor eax, eax
jmp 0x597585
mov al, 1
and al, 1
pop esi
pop edi
pop ebx
pop ebp
ret
push 0x676e30
push 0x2b
push 0x675f4d
call fcn.005a0b60
add esp, 0xc
ud2
push 0x676e40
push ebp
push ebx
call fcn.005a1030
add esp, 0xc
ud2
push 0x676e40
push dword [esp + 0x20]
push ebp
call fcn.005a0fc0
add esp, 0xc
ud2

Function at 0x5998f7
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.kernel32.dll_GetModuleHandleW]
test eax, eax
je 0x599936
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x599936
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x599936
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x599936
cmp dword [ecx + 0x74], 0xe
jbe 0x599936
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x59fd10
Capabilities:
Resolve dns

Disassembly:
push ebx
push edi
push esi
sub esp, 0x34
mov esi, ecx
lea eax, [esp + 4]
push dword [esp + 0x44]
push edx
push eax
call fcn.0058c800
add esp, 0xc
mov eax, dword [esp + 4]
test eax, eax
je 0x59fd62
mov ecx, dword [0x673008]
mov edx, dword [0x67300c]
mov dword [esi + 4], ecx
mov ecx, dword [esp + 8]
mov dword [esi + 8], edx
mov dword [esi], 1
test ecx, ecx
je 0x59fdc5
push 1
push ecx
push eax
call fcn.00407080
add esp, 0x40
pop esi
pop edi
pop ebx
ret
mov edi, dword [esp + 8]
mov ebx, dword [esp + 0xc]
xorps xmm0, xmm0
mov eax, esp
mov dword [esp], 0
lea ecx, [esp + 0x14]
movups xmmword [esp + 0x14], xmm0
movups xmmword [esp + 0x24], xmm0
mov dword [esp + 0x1c], 1
push eax
push ecx
push 0
push edi
call dword [sym.imp.ws2_32.dll_getaddrinfo]
test eax, eax
je 0x59fdcc
call dword [sym.imp.ws2_32.dll_WSAGetLastError]
mov dword [esi + 8], eax
mov dword [esi + 4], 0
mov eax, 1
test ebx, ebx
mov dword [esi], eax
mov byte [edi], 0
je 0x59fdc5
push 1
push ebx
push edi
call fcn.00407080
add esp, 0xc
add esp, 0x34
pop esi
pop edi
pop ebx
ret
mov ecx, dword [esp]
movzx eax, word [esp + 0x48]
mov dword [esi + 4], ecx
mov dword [esi + 8], ecx
mov word [esi + 0xc], ax
xor eax, eax
test ebx, ebx
mov dword [esi], eax
mov byte [edi], 0
jne 0x59fdb9
jmp 0x59fdc5
Function at 0x59fef0
Capabilities:
Allocate thread local storage

Disassembly:
push ebx
push edi
push esi
sub esp, 0x20
mov edi, dword [esp + 0x30]
cmp dword [edi + 4], 0
je 0x59ff71
lea ebx, [edi + 0xc]
mov dword [esp + 4], 0
lea eax, [esp + 4]
push 0
push eax
push 0
push ebx
call dword [sym.imp.kernel32.dll_InitOnceBeginInitialize]
cmp eax, 1
mov dword [esp], eax
jne 0x59ffac
cmp dword [esp + 4], 0
je 0x59ff93
call dword [sym.imp.kernel32.dll_TlsAlloc]
cmp eax, 0xffffffff
je 0x59ffcf
mov esi, eax
inc eax
mov dword [edi], eax
mov eax, dword [0x69b958]
nop word [eax + eax]
mov dword [edi + 8], eax
lock cmpxchg dword [0x69b958], edi
jne 0x59ff50
mov byte [0x69b954], 1
push 0
push 0
push ebx
call dword [sym.imp.kernel32.dll_InitOnceComplete]
jmp 0x59ffa3
call dword [sym.imp.kernel32.dll_TlsAlloc]
cmp eax, 0xffffffff
mov dword [esp], eax
je 0x5a0016
mov ecx, eax
xor eax, eax
inc ecx
lock cmpxchg dword [edi], ecx
jne 0x59ff97
mov esi, dword [esp]
jmp 0x59ffa3
mov esi, dword [edi]
jmp 0x59ffa2
mov esi, eax
push dword [esp]
call dword [sym.imp.kernel32.dll_TlsFree]
dec esi
mov eax, esi
add esp, 0x20
pop esi
pop edi
pop ebx
ret
mov dword [esp + 8], 0
lea eax, [esp + 8]
mov ecx, esp
mov edx, 0x673f18
push 0x673f78
push eax
call fcn.0059f980
add esp, 8
ud2
push 0
push 4
push ebx
call dword [sym.imp.kernel32.dll_InitOnceComplete]
mov dword [esp + 8], 0x673f30
mov dword [esp + 0xc], 1
mov dword [esp + 0x18], 0
mov dword [esp + 0x10], 0x671fac
mov dword [esp + 0x14], 0
lea eax, [esp + 8]
push 0x673f68
push eax
call fcn.005a0aa0
add esp, 8
ud2
mov ecx, esp
lea edx, [esp + 8]
mov dword [esp + 8], 0x673f30
mov dword [esp + 0xc], 1
mov dword [esp + 0x10], 0x671fac
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
call fcn.0059fa00
ud2
Function at 0x5a0d50
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
push edi
push esi
sub esp, 0x68
movzx eax, byte [esp + 0x78]
mov esi, dword [esp + 0x84]
mov ebx, dword [esp + 0x7c]
mov ecx, dword [esp + 0x8c]
mov edx, dword [esp + 0x88]
mov edi, dword [esp + 0x80]
test eax, eax
mov dword [esp + 8], ebx
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], edi
mov dword [esp + 0x14], edx
je 0x5a0da1
cmp eax, 1
jne 0x5a0e18
mov dword [esp], 0x676672
jmp 0x5a0da8
mov dword [esp], str._matchesassertion__left__right__failed_n__left:__n_right:
mov edx, 2
mov eax, dword [esp + 0x90]
cmp dword [ecx], 0
mov dword [esp + 4], edx
jne 0x5a0e34
mov ecx, esp
lea edx, [esp + 8]
lea esi, [esp + 0x10]
mov dword [esp + 0x38], 0x6766ac
mov dword [esp + 0x3c], 3
mov dword [esp + 0x48], 0
mov dword [esp + 0x18], ecx
mov dword [esp + 0x1c], 0x598d60
mov dword [esp + 0x20], edx
lea edx, [esp + 0x18]
mov dword [esp + 0x24], 0x598ce0
mov dword [esp + 0x28], esi
mov dword [esp + 0x2c], 0x598ce0
mov dword [esp + 0x40], edx
mov dword [esp + 0x44], 3
jmp 0x5a0eba
mov edx, 7
mov dword [esp], 0x676674
mov eax, dword [esp + 0x90]
cmp dword [ecx], 0
mov dword [esp + 4], edx
je 0x5a0dbd
movsd xmm0, qword [ecx + 0x10]
movsd xmm2, qword [ecx]
movsd xmm1, qword [ecx + 8]
mov edx, esp
lea esi, [esp + 0x50]
mov dword [esp + 0x38], 0x6766e0
mov dword [esp + 0x3c], 4
mov dword [esp + 0x48], 0
mov dword [esp + 0x18], edx
lea edx, [esp + 8]
mov dword [esp + 0x1c], 0x598d60
mov dword [esp + 0x20], esi
mov dword [esp + 0x24], 0x593da0
lea esi, [esp + 0x10]
mov dword [esp + 0x28], edx
lea edx, [esp + 0x18]
mov dword [esp + 0x2c], 0x598ce0
mov dword [esp + 0x30], esi
mov dword [esp + 0x34], 0x598ce0
mov dword [esp + 0x40], edx
mov dword [esp + 0x44], 4
movsd qword [esp + 0x60], xmm0
movsd qword [esp + 0x58], xmm1
movsd qword [esp + 0x50], xmm2
lea ecx, [esp + 0x38]
push eax
push ecx
call fcn.005a0aa0
add esp, 8
ud2
Function at 0x401040
Capabilities:
Get process heap flags
Terminate process

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xc
mov dword [esp], 1
call sym.__configure_narrow_argv
call sym.__initialize_narrow_environment
call sym.___p___argc
mov esi, dword [eax]
call sym.___p___argv
mov edi, dword [eax]
call sym.__get_initial_narrow_environment
mov ebx, eax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 8]
mov edx, dword [eax + 0x3c]
cmp word [eax + edx + 0x5c], 2
sete al
movzx eax, al
add eax, 1
mov dword [esp], eax
call sym.__set_app_type
mov dword [esp + 8], ebx
mov dword [esp + 4], edi
mov dword [esp], esi
call sym._main
mov dword [esp], eax
call sym._exit
nop
nop
nop

Function at 0x401100
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x54
call sym.___main
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov ebx, eax
movzx eax, byte [eax]
test al, al
je 0x40115e
xor ecx, ecx
xor edx, edx
jmp 0x40113e
cmp al, 0x5c
jne 0x4011b0
add edx, 1
movzx eax, byte [ebx + 1]
add ebx, 1
test al, al
je 0x401153
cmp al, 9
je 0x401146
cmp al, 0x20
jne 0x401128
test ecx, ecx
je 0x401153
xor edx, edx
jmp 0x401133
add ebx, 1
movzx eax, byte [ebx]
cmp al, 9
je 0x401150
cmp al, 0x20
je 0x401150
lea eax, [ebp - 0x4c]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_GetStartupInfoA]
sub esp, 4
test byte [ebp - 0x20], 1
jne 0x401179
mov word [ebp - 0x1c], 1
movzx esi, word [ebp - 0x1c]
mov dword [esp], 0
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
sub esp, 4
mov dword [esp + 0xc], esi
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov dword [esp], eax
call sym._WinMain_16
sub esp, 0x10
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
cmp al, 0x22
jne 0x40114a
and edx, 1
jne 0x40114a
xor ecx, 1
jmp 0x401133
Function at 0x41e02d
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x41e06c
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x41e06c
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x41e06c
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x41e06c
cmp dword [ecx + 0x74], 0xe
jbe 0x41e06c
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x42402f
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x42e338
push 0x42e330
push str.FlsAlloc
push 0x1f
call fcn.00423eee
mov esi, eax
add esp, 0x10
test esi, esi
je 0x424063
push dword [ebp + 8]
mov ecx, esi
call dword [0x42c144]
call esi
jmp 0x424069
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x4240ad
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x42e348
push 0x42e340
push str.FlsGetValue
push 0x21
call fcn.00423eee
mov esi, eax
add esp, 0x10
test esi, esi
je 0x4240e4
push dword [ebp + 8]
mov ecx, esi
call dword [0x42c144]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x4240ec
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x42e350
push 0x42e348
push str.FlsSetValue
push 0x22
call fcn.00423eee
mov esi, eax
add esp, 0x10
test esi, esi
je 0x424126
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x42c144]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x4258de
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x42597b
push ebx
push esi
call fcn.004258a7
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.0042583b
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x425928
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x42597a
push edi
push eax
call fcn.004242f1
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x425948
call fcn.0042433f
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x425979
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.0042583b
add esp, 0x20
test eax, eax
jne 0x425967
push edi
call fcn.0042433f
jmp 0x42596f
push ebx
call fcn.0042433f
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret
Function at 0x42bbc0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x42bbed
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x42bbed
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x414b30
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0xe000]
push edi
or ebp, 0xffffffff
jmp 0x414b52
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x414b59
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x414b48
mov eax, 1
add ebx, ebx
jne 0x414b6b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x414b60
jne 0x414b7c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x414b60
xor ecx, ecx
sub eax, 3
jb 0x414b90
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x414c02
mov ebp, eax
add ebx, ebx
jne 0x414b9b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x414ba8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x414bcc
inc ecx
add ebx, ebx
jne 0x414bb8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x414bad
jne 0x414bc9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x414bad
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x414bec
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x414bdd
jmp 0x414b4e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x414bec
add edi, ecx
jmp 0x414b4e
pop esi
mov edi, esi
mov ecx, 0x43b
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x414c0a
cmp byte [edi], 0
jne 0x414c0a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x414c0f
lea edi, [esi + 0x12000]
mov eax, dword [edi]
or eax, eax
je 0x414c7e
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x15bbc]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x15c44]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x414c3c
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x15c4c]
or eax, eax
je 0x414c78
pop es
mov dword [ebx], eax
add ebx, 4
jmp 0x414c59
call dword [esi + 0x15c48]
mov ebp, dword [esi + 0x15c50]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x21f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x414cb2
sub esp, 0xffffff80
jmp 0x409820
Function at 0x426910
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x1c000]
push edi
jmp 0x42692a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x426931
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x426920
mov eax, 1
add ebx, ebx
jne 0x426943
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x426938
jne 0x426954
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x426938
xor ecx, ecx
sub eax, 3
jb 0x426968
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x4269da
mov ebp, eax
add ebx, ebx
jne 0x426973
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x426980
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x4269a4
inc ecx
add ebx, ebx
jne 0x426990
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x426985
jne 0x4269a1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x426985
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x4269c4
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x4269b5
jmp 0x426926
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x4269c4
add edi, ecx
jmp 0x426926
pop esi
mov edi, esi
mov ecx, 0x13ba
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x4269e2
cmp byte [edi], 5
jne 0x4269e2
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x4269e7
lea edi, [esi + 0x24000]
mov eax, dword [edi]
or eax, eax
je 0x426a5f
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x2739c]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x273d8]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x426a14
mov ecx, edi
jns 0x426a43
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x273e0]
or eax, eax
je 0x426a59
mov dword [ebx], eax
add ebx, 4
jmp 0x426a31
call dword [esi + 0x273dc]
mov ebp, dword [esi + 0x273e4]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1d7]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x426a93
sub esp, 0xffffff80
jmp 0x40323c
Function at 0x1000b197
Capabilities:
Parse pe header

Disassembly:
push esi
mov esi, ecx
test si, si
jne 0x1000b24c
mov eax, 0x5a4d
cmp word [esi], ax
jne 0x1000b24c
mov edx, dword [esi + 0x3c]
test dl, 3
jne 0x1000b24c
cmp dword [edx + esi], 0x4550
jne 0x1000b24c
cmp dword [edx + esi + 0x74], 6
jb 0x1000b24c
push ebx
mov ebx, dword [edx + esi + 0x50]
push edi
mov edi, dword [edx + esi + 0xa8]
lea eax, [ebx - 1]
lea ecx, [edi - 1]
cmp ecx, eax
jae 0x1000b24a
mov eax, dword [edx + esi + 0xac]
mov ecx, ebx
sub ecx, edi
cmp eax, ecx
ja 0x1000b24a
xor edx, edx
add edi, esi
push 0x1c
pop ecx
div ecx
mov edx, eax
test edx, edx
je 0x1000b24a
imul ecx, edx, 0x1c
add ecx, 0x14
add ecx, edi
lea ecx, [ecx - 0x1c]
dec edx
cmp dword [ecx - 8], 2
lea edi, [ecx - 0x14]
jne 0x1000b228
cmp dword [ecx], ebx
jae 0x1000b228
mov eax, ebx
sub eax, dword [ecx]
cmp dword [ecx - 4], eax
jbe 0x1000b22e
test edx, edx
jne 0x1000b20e
jmp 0x1000b24a
push 0x1c
push edi
call dword [sym.imp.kernel32.dll_VirtualLock]
test eax, eax
je 0x1000b24a
mov eax, dword [edi + 0x14]
push dword [edi + 0x10]
add eax, esi
push eax
call dword [sym.imp.kernel32.dll_VirtualLock]
pop edi
pop ebx
pop esi
ret

Function at 0x1000c446
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
pushal
call 0x1000c455
pop dword [ebp - 4]
mov eax, 0x1f5af49
sub eax, 0xf1f4eaf4
sub dword [ebp - 4], eax
push 0x40
push 0x1000
push 0x3940d
push 0
mov eax, 0x8b2befea
sub eax, 0x7b2aaf86
add eax, dword [ebp - 4]
call dword [eax]
mov ecx, 0x9f94e6ae
add ecx, 0x606b626e
xor esi, esi
add esi, eax
mov edx, 0x10018600
add edx, dword [ebp - 4]
mov ebx, 0xe9caed93
sub ebx, 0x909c3220
mov edi, dword [edx]
xor edi, ebx
mov dword [esi], edi
add esi, 0x29b6139e
add esi, 0xd649ec66
add edx, 0xe70a2bf2
add edx, 0x18f5d412
loop 0x1000c4b0
add eax, 0x11743
mov ebx, eax
add eax, 0xb9193f9b
add eax, 0x46e6c06a
mov ecx, 0x10000000
add ecx, dword [ebp - 4]
call ebx
leave
ret