joyce8/EMBER2024-capa huggingface dataset:
Function at 0x458015
Capabilities:
Clear file content

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
mov ebx, dword [ebp + 8]
lea ecx, [ebp - 0x2c]
push esi
push edi
push dword [ebp + 0x10]
mov edi, dword [ebp + 0x14]
push dword [ebp + 0xc]
push ebx
call fcn.00457f91
mov eax, dword [ebp - 0x2c]
and eax, dword [ebp - 0x28]
cmp eax, 0xffffffff
je 0x458184
mov eax, dword [ebp - 0x24]
and eax, dword [ebp - 0x20]
cmp eax, 0xffffffff
je 0x458184
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
test ecx, ecx
jl 0x458139
jg 0x458071
test eax, eax
je 0x45812f
push 1
push 0x1000
call fcn.00449280
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x458094
push 0xc
pop ebx
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], ebx
jmp 0x458126
push 0x8000
push ebx
call fcn.00445d51
pop ecx
pop ecx
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x18]
test eax, eax
jl 0x4580bd
jg 0x4580b8
cmp ecx, 0x1000
jb 0x4580bd
mov ecx, 0x1000
push edi
push ecx
push esi
push ebx
call fcn.00449ced
add esp, 0x10
cmp eax, 0xffffffff
je 0x458102
mov ecx, dword [ebp - 4]
cdq
sub ecx, eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], ecx
sbb eax, edx
mov dword [ebp - 8], eax
test eax, eax
jg 0x4580b8
jl 0x4580e9
test ecx, ecx
jne 0x4580aa
push dword [ebp - 0xc]
push ebx
call fcn.00445d51
push esi
call fcn.00449f10
add esp, 0xc
xor ebx, ebx
jmp 0x458192
cmp byte [edi + 0x24], 0
je 0x458119
cmp dword [edi + 0x20], 5
jne 0x458119
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], 0xd
cmp byte [edi + 0x1c], 0
je 0x458124
mov ebx, dword [edi + 0x18]
jmp 0x458126
xor ebx, ebx
push esi
call fcn.00449f10
pop ecx
jmp 0x458192
test ecx, ecx
jg 0x4580fb
jl 0x458139
test eax, eax
jae 0x4580fb
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.0044d5ef
and eax, edx
add esp, 0x10
cmp eax, 0xffffffff
jne 0x458159
cmp byte [edi + 0x1c], 0
je 0x4580fb
jmp 0x45818a
push ebx
call fcn.00450782
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x4580fb
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0xd
mov byte [edi + 0x24], 1
mov dword [edi + 0x20], eax
pop ebx
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], ebx
jmp 0x458192
cmp byte [edi + 0x1c], 0
je 0x45818f
mov ebx, dword [edi + 0x18]
jmp 0x458192
push 0x16
pop ebx
push 0
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
push dword [ebp - 0x14]
call fcn.0044d5ef
add esp, 0x10
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret

Function at 0x4589d0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4589fd
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4589fd
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x710c64
Capabilities:
Encode data using xor

Disassembly:
mov esi, 0x7109ec
inc eax
add eax, ebx
call fcn.00710ca0
dec eax
inc ebx
xor dword [edx], esi
sub eax, 0x85daff5a
push eax
pop ebx
dec ebx
inc edx
add eax, 0x2bd68c05
mov ebx, eax
cmp edx, ecx
jne fcn.00710c64
add eax, 0xa2f49863
or ebx, eax
sub eax, 0x14dbf16
ret
Function at 0xb37380
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, 0x847015
lea edi, [esi - 0x446015]
push edi
or ebp, 0xffffffff
jmp 0xb373a2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0xb373a9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xb37398
mov eax, 1
add ebx, ebx
jne 0xb373bb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0xb373cc
jne 0xb373eb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xb373eb
dec eax
add ebx, ebx
jne 0xb373d8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0xb373b0
add ebx, ebx
jne 0xb373e7
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0xb3743d
xor ecx, ecx
sub eax, 3
jb 0xb37403
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0xb37472
sar eax, 1
mov ebp, eax
jmp 0xb3740e
add ebx, ebx
jne 0xb3740e
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xb373dc
inc ecx
add ebx, ebx
jne 0xb3741c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xb373dc
add ebx, ebx
jne 0xb37429
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0xb3741e
jne 0xb3743a
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0xb3741e
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0xb3745c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0xb3744e
jmp 0xb3739e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0xb3745c
add edi, ecx
jmp 0xb3739e
pop esi
mov edi, esi
mov ecx, 0x600269
mov al, 0xe8
repne scasb al, byte es:[edi]
jne 0xb37497
cmp byte [edi], 0x2e
jne 0xb3747c
mov eax, dword [edi]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
add eax, esi
stosd dword es:[edi], eax
jmp 0xb3747a
lea edi, [esi + 0x735000]
mov eax, dword [edi]
or eax, eax
je 0xb374df
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x737000]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x737050]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0xb3749d
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x737058]
or eax, eax
je 0xb374d9
mov dword [ebx], eax
add ebx, 4
jmp 0xb374ba
call dword [esi + 0x737054]
mov ebp, dword [esi + 0x73705c]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x19f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0xb37513
sub esp, 0xffffff80
jmp 0x44d3e0
Function at 0x40582f5c
Capabilities:
Set registry value

Disassembly:
push esi
push dword [esp + 8]
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
push eax
push dword [esp + 0xc]
push 1
push 0
push dword [esp + 0x1c]
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
pop esi
ret 8

Function at 0x405834ba
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
mov edi, ecx
mov esi, 0x1000
push esi
mov dword [ebp - 0x14], edi
call fcn.40586abb
mov ebx, eax
test ebx, ebx
pop ecx
mov dword [ebp - 0x18], ebx
jne 0x405834e7
mov eax, 0x8007000e
jmp 0x40583676
push ebx
mov ecx, edi
call fcn.405833e1
test eax, eax
jge 0x405834fa
mov esi, eax
jmp 0x40583667
lea eax, [ebp - 2]
push eax
push ebx
call fcn.405832a8
test eax, eax
pop ecx
pop ecx
jne 0x40583514
mov esi, 0x80020009
jmp 0x40583667
push esi
call fcn.40586abb
mov esi, eax
test esi, esi
pop ecx
mov dword [ebp - 8], esi
jne 0x4058352e
mov esi, 0x8007000e
jmp 0x40583667
mov ecx, edi
call fcn.405833bf
push esi
mov ecx, edi
call fcn.405833e1
test eax, eax
jl 0x4058365c
movzx eax, word [ebp - 2]
sub eax, 8
je 0x40583641
sub eax, 9
je 0x405835a6
dec eax
dec eax
jne 0x4058364d
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov esi, eax
inc esi
lea eax, [esi + esi]
add eax, 3
and eax, 0xfffffffc
call fcn.40586d20
mov eax, esp
xor edi, edi
push edi
push esi
push dword [ebp - 8]
push eax
call fcn.40582dcd
lea ecx, [ebp - 0x10]
push ecx
push edi
push edi
push eax
call dword [sym.imp.OLEAUT32.dll_VarUI4FromDisp]
push dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
push dword [ebp - 0x10]
call fcn.40582f42
jmp 0x4058364d
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
test al, 1
mov dword [ebp - 0xc], eax
je 0x405835be
mov esi, 0x80004005
jmp 0x4058365e
cdq
sub eax, edx
mov ebx, eax
sar ebx, 1
mov eax, ebx
add eax, 3
and eax, 0xfffffffc
call fcn.40586d20
mov ecx, ebx
mov edx, ecx
shr ecx, 2
xor eax, eax
mov edi, esp
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
xor edi, edi
cmp esp, edi
mov dword [ebp - 4], esp
je 0x405835b4
cmp dword [ebp - 0xc], edi
jle 0x40583628
mov ecx, dword [ebp - 4]
mov eax, edi
cdq
sub eax, edx
sar eax, 1
lea esi, [eax + ecx]
mov eax, dword [ebp - 8]
movsx eax, byte [edi + eax]
push eax
call fcn.40583327
pop ecx
mov ecx, edi
and ecx, 1
shl ecx, 2
mov edx, ecx
push 4
pop ecx
sub ecx, edx
shl al, cl
or byte [esi], al
inc edi
cmp edi, dword [ebp - 0xc]
jl 0x405835f4
mov eax, dword [ebp + 8]
mov eax, dword [eax]
push ebx
push dword [ebp - 4]
push 3
push 0
push dword [ebp + 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
jmp 0x4058364d
push dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
push esi
call fcn.40582f5c
push dword [ebp + 0x10]
mov ecx, dword [ebp - 0x14]
call fcn.405833e1
test eax, eax
jge 0x40583674
mov esi, eax
push dword [ebp - 8]
call fcn.40586acd
pop ecx
push dword [ebp - 0x18]
call fcn.40586acd
pop ecx
mov eax, esi
jmp 0x40583676
xor eax, eax
lea esp, [ebp - 0x24]
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x40583e15
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
push ebx
push esi
push 0x2001f
push dword [ebp + 8]
mov ebx, ecx
push dword [ebx]
xor esi, esi
lea ecx, [ebp - 4]
mov dword [ebp - 4], esi
call fcn.40582f0d
cmp eax, esi
jne 0x40583e8d
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
jmp 0x40583e56
lea eax, [ebp - 0x110]
push eax
call fcn.40583e15
cmp eax, esi
jne 0x40583e8c
lea eax, [ebp - 0x10]
push eax
push esi
push esi
push esi
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x110]
push eax
push esi
push dword [ebp - 4]
mov dword [ebp - 8], 0x100
call edi
test eax, eax
lea ecx, [ebp - 4]
je 0x40583e46
call fcn.40582ea8
push dword [ebp + 8]
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
pop edi
lea ecx, [ebp - 4]
mov esi, eax
call fcn.40582ea8
mov eax, esi
pop esi
pop ebx
leave
ret 4
Function at 0x40584a07
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
xor ebx, ebx
cmp dword [ebp + 8], ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov dword [ebp - 8], ebx
jne 0x40584a20
xor eax, eax
jmp 0x40584a47
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea esi, [eax + eax + 2]
mov eax, esi
add eax, 3
and eax, 0xfffffffc
call fcn.40586d20
mov eax, esp
push ebx
push esi
push dword [ebp + 8]
push eax
call fcn.40582df3
push 2
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov esi, eax
cmp esi, ebx
mov dword [ebp + 8], esi
jne 0x40584a84
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
test eax, eax
jg 0x40584a6f
call esi
mov esi, eax
jmp 0x40584b1a
call esi
mov esi, eax
and esi, 0xffff
or esi, 0x80070000
jmp 0x40584b1a
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
cmp edi, ebx
je 0x40584aa5
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
cmp esi, ebx
jne 0x40584ac7
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
test eax, eax
jg 0x40584ab5
call esi
jmp 0x40584b0f
call esi
mov esi, eax
and esi, 0xffff
or esi, 0x80070000
jmp 0x40584b11
push edi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebx, eax
cmp byte [ebx + esi], 0
mov eax, esi
je 0x40584b03
lea edi, [ebx + 1]
mov eax, edi
add eax, 3
and eax, 0xfffffffc
call fcn.40586d20
mov ecx, edi
mov edx, ecx
shr ecx, 2
mov eax, esp
mov edi, eax
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
and byte [eax + ebx], 0
push dword [ebp + 0x14]
lea ecx, [ebp - 8]
push eax
call fcn.40584719
mov esi, eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, esi
lea esp, [ebp - 0x14]
pop edi
pop esi
pop ebx
leave
ret 0x10
Function at 0x405867c6
Capabilities:
Accept command line arguments
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
cmp eax, 1
push esi
jne 0x405868ae
mov eax, 0x94
call fcn.40586d20
mov esi, esp
push esi
mov dword [esi], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x40586923
mov ecx, dword [esi + 0x10]
mov dword [0x4058dedc], ecx
mov eax, dword [esi + 4]
mov dword [0x4058dee8], eax
mov edx, dword [esi + 8]
mov dword [0x4058deec], edx
mov esi, dword [esi + 0xc]
and esi, 0x7fff
cmp ecx, 2
mov dword [0x4058dee0], esi
je 0x40586831
or esi, 0x8000
mov dword [0x4058dee0], esi
shl eax, 8
add eax, edx
push 1
mov dword [0x4058dee4], eax
call fcn.405880a9
test eax, eax
pop ecx
je 0x40586923
call fcn.405879c2
test eax, eax
jne 0x4058685e
call fcn.405880fa
jmp 0x40586923
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [0x4058e6b0], eax
call fcn.40587f69
mov dword [0x4058dec0], eax
call fcn.40587a31
test eax, eax
jl 0x405868a7
call fcn.40587ec7
test eax, eax
jl 0x405868a2
call fcn.40587c7b
test eax, eax
jl 0x405868a2
call fcn.40587676
test eax, eax
jne 0x405868a2
inc dword [0x4058debc]
jmp 0x40586934
call fcn.40587c2f
call fcn.405877b5
jmp 0x40586854
test eax, eax
jne 0x405868de
cmp dword [0x4058debc], eax
jle 0x40586923
dec dword [0x4058debc]
cmp dword [0x4058df18], eax
jne 0x405868cd
call fcn.405877a6
call fcn.40587c2f
call fcn.405877b5
call fcn.405880fa
jmp 0x40586934
cmp eax, 2
jne 0x40586927
push 0x88
push 1
call fcn.40586d66
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x40586923
push esi
push dword [0x4058d230]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
push esi
je 0x4058691d
call fcn.405877d3
pop ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
or dword [esi + 4], 0xffffffff
mov dword [esi], eax
jmp 0x40586934
call fcn.40586acd
pop ecx
xor eax, eax
jmp 0x40586937
cmp eax, 3
jne 0x40586934
push 0
call fcn.40587857
pop ecx
xor eax, eax
inc eax
lea esp, [ebp - 4]
pop esi
pop ebp
ret 0xc
Function at 0x40588179
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
mov edx, dword [ebp + 8]
push ebx
push esi
push edi
xor eax, eax
cmp edx, dword [eax*8 + 0x4058d260]
je 0x40588199
inc eax
cmp eax, 0x12
jb 0x4058818a
shl eax, 3
cmp edx, dword [eax + 0x4058d260]
mov dword [ebp + 8], eax
jne 0x40588337
mov ecx, dword [0x4058dec8]
cmp ecx, 1
je 0x4058830c
test ecx, ecx
jne 0x405881cb
cmp dword [0x4058decc], 1
je 0x4058830c
cmp edx, 0xfc
je 0x40588337
and byte [ebp - 8], 0
push 0x104
lea eax, [ebp - 0x10c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x40588206
push 5
pop ecx
mov esi, 0x405824ec
lea edi, [ebp - 0x10c]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
lea eax, [ebp - 0x10c]
lea ebx, [ebp - 0x10c]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40588215
sub eax, edx
inc eax
cmp eax, 0x3c
jbe 0x4058824d
lea eax, [ebp - 0x10c]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4058822d
sub eax, edx
push 3
lea ebx, [ebp + eax - 0x147]
push 0x405824e8
push ebx
call fcn.40587220
add esp, 0xc
mov eax, ebx
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40588252
sub eax, edx
mov ecx, eax
mov eax, dword [ebp + 8]
mov eax, dword [eax + str.x_X__b]
lea esi, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x40588269
sub eax, esi
lea eax, [eax + ecx + 0x1c]
add eax, 3
and eax, 0xfffffffc
call fcn.40586d20
mov edx, esp
push 6
pop ecx
mov esi, 0x405824cc
mov edi, edx
rep movsd dword es:[edi], dword [esi]
mov eax, ebx
movsw word es:[edi], word [esi]
mov esi, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40588295
mov edi, edx
sub eax, esi
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x405882a1
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, edx
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x405882ba
mov eax, dword [ebp + 8]
mov esi, 0x405824c8
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
mov eax, dword [eax + str.x_X__b]
mov esi, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x405882d5
mov edi, edx
sub eax, esi
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x405882e1
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
push 0x12010
mov ecx, eax
and ecx, 3
push 0x405824a0
push edx
rep movsb byte es:[edi], byte [esi]
call fcn.4058a10e
add esp, 0xc
jmp 0x40588337
mov ecx, dword [eax + str.x_X__b]
mov eax, ecx
lea esi, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x40588317
push 0
lea edx, [ebp - 4]
push edx
sub eax, esi
push eax
push ecx
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
lea esp, [ebp - 0x118]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40589ae0
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
push ebx
push esi
push edi
push 4
pop eax
call fcn.40586d20
mov ebx, esp
push 0x1c
lea eax, [ebp - 0x24]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x40589b75
mov edi, dword [ebp - 0x20]
lea eax, [ebp - 0x48]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [ebp - 0x44]
lea esi, [eax - 1]
not esi
and esi, ebx
sub esi, eax
mov dword [ebp - 4], eax
mov eax, dword [0x4058dedc]
mov ecx, eax
dec ecx
neg ecx
sbb ecx, ecx
and ecx, 0xffff1000
add ecx, 0x11000
add ecx, edi
cmp esi, ecx
jb 0x40589b75
cmp eax, 1
je 0x40589b8d
mov ebx, edi
mov edi, 0x1000
push 0x1c
lea eax, [ebp - 0x24]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x40589b75
add ebx, dword [ebp - 0x18]
test dword [ebp - 0x14], edi
je 0x40589b4a
test byte [ebp - 0xf], 1
mov ebx, dword [ebp - 0x24]
je 0x40589b71
xor eax, eax
inc eax
jmp 0x40589ba9
cmp esi, ebx
jae 0x40589b79
xor eax, eax
jmp 0x40589ba9
push 4
push edi
push dword [ebp - 4]
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov eax, dword [0x4058dedc]
jmp 0x40589b8f
mov ebx, esi
dec eax
neg eax
sbb eax, eax
and eax, 0x103
lea ecx, [ebp - 8]
push ecx
inc eax
push eax
push dword [ebp - 4]
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea esp, [ebp - 0x54]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x4058a10e
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
xor ebx, ebx
cmp dword [0x4058e1a0], ebx
push esi
push edi
jne 0x4058a18e
push 0x40582788
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x4058a1c9
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x4058277c
push edi
call esi
test eax, eax
mov dword [0x4058e1a0], eax
je 0x4058a1c9
push 0x4058276c
push edi
call esi
push 0x40582758
push edi
mov dword [0x4058e1a4], eax
call esi
cmp dword [0x4058dedc], 2
mov dword [0x4058e1a8], eax
jne 0x4058a18e
push 0x4058273c
push edi
call esi
test eax, eax
mov dword [0x4058e1b0], eax
je 0x4058a18e
push 0x40582724
push edi
call esi
mov dword [0x4058e1ac], eax
mov eax, dword [0x4058e1ac]
test eax, eax
je 0x4058a1d3
call eax
test eax, eax
je 0x4058a1ba
lea ecx, [ebp - 4]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [0x4058e1b0]
test eax, eax
je 0x4058a1ba
test byte [ebp - 8], 1
jne 0x4058a1d3
cmp dword [0x4058dee8], 4
jb 0x4058a1cd
or byte [ebp + 0x12], 0x20
jmp 0x4058a1f2
xor eax, eax
jmp 0x4058a202
or byte [ebp + 0x12], 4
jmp 0x4058a1f2
mov eax, dword [0x4058e1a4]
test eax, eax
je 0x4058a1f2
call eax
mov ebx, eax
test ebx, ebx
je 0x4058a1f2
mov eax, dword [0x4058e1a8]
test eax, eax
je 0x4058a1f2
push ebx
call eax
mov ebx, eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push ebx
call dword [0x4058e1a0]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x45e960
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x4e000]
push edi
jmp 0x45e97a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x45e981
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x45e970
mov eax, 1
add ebx, ebx
jne 0x45e993
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x45e9a4
jne 0x45e9c3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x45e9c3
dec eax
add ebx, ebx
jne 0x45e9b0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x45e988
add ebx, ebx
jne 0x45e9bf
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x45ea15
xor ecx, ecx
sub eax, 3
jb 0x45e9db
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x45ea4a
sar eax, 1
mov ebp, eax
jmp 0x45e9e6
add ebx, ebx
jne 0x45e9e6
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x45e9b4
inc ecx
add ebx, ebx
jne 0x45e9f4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x45e9b4
add ebx, ebx
jne 0x45ea01
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x45e9f6
jne 0x45ea12
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x45e9f6
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x45ea34
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x45ea26
jmp 0x45e976
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x45ea34
add edi, ecx
jmp 0x45e976
pop esi
mov edi, esi
mov ecx, 0xa57
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x45ea52
cmp byte [edi], 0x12
jne 0x45ea52
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x45ea57
lea edi, [esi + 0x5c000]
mov eax, dword [edi]
or eax, eax
je 0x45eacf
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x97ba4]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x97c84]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x45ea84
mov ecx, edi
jns 0x45eab3
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x97c8c]
or eax, eax
je 0x45eac9
mov dword [ebx], eax
add ebx, 4
jmp 0x45eaa1
call dword [esi + 0x97c88]
mov ebp, dword [esi + 0x97c90]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x17f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x45eb03
sub esp, 0xffffff80
jmp 0x41942f