joyce8/EMBER2024-capa huggingface dataset:
Function at 0x529b4e
Capabilities:
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
sub esp, 0xc
mov eax, dword [ebp + 8]
and eax, 0xffff
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0xc]
and eax, 0xff0000
shr eax, 0x10
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0xc]
and eax, 0x1000000
cmp eax, 0
setne al
xor ah, ah
cwde
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
cmp eax, 0x10
je 0x529ba6
cmp eax, 0x11
je 0x529bb6
cmp eax, 0x12
je 0x529bd1
mov eax, 0
jmp 0x529bea
push 3
push dword [ebp - 0xc]
call dword [sym.imp.USER32.DLL_MapVirtualKeyW]
mov dword [ebp - 0x10], eax
jmp 0x529bea
mov eax, dword [ebp - 0x14]
cmp eax, 0
je 0x529bc7
mov eax, 0xa3
jmp 0x529bcc
mov eax, 0xa2
mov dword [ebp - 0x10], eax
jmp 0x529bea
mov eax, dword [ebp - 0x14]
cmp eax, 0
je 0x529be2
mov eax, 0xa5
jmp 0x529be7
mov eax, 0xa4
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
leave
ret 8

Function at 0x529bf1
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
sub esp, 4
mov eax, 0
mov dword [ebp - 0xc], 0
push 0x11
call dword [sym.imp.USER32.DLL_GetKeyState]
and eax, 0x8000
cmp eax, 0
je 0x529c27
mov eax, 0x10000000
mov dword [ebp - 0xc], 0x10000000
push 0x10
call dword [sym.imp.USER32.DLL_GetKeyState]
and eax, 0x8000
cmp eax, 0
je 0x529c46
mov eax, dword [ebp - 0xc]
or eax, 0x20000000
mov dword [ebp - 0xc], eax
push 0x12
call dword [sym.imp.USER32.DLL_GetKeyState]
and eax, 0x8000
cmp eax, 0
je 0x529c65
mov eax, dword [ebp - 0xc]
or eax, 0x40000000
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 8]
xor al, 1
cmp eax, 0
je 0x529ced
push 1
call dword [sym.imp.USER32.DLL_GetKeyState]
and eax, 0x8000
cmp eax, 0
je 0x529c90
mov eax, dword [ebp - 0xc]
or eax, 0x2000000
mov dword [ebp - 0xc], eax
push 2
call dword [sym.imp.USER32.DLL_GetKeyState]
and eax, 0x8000
cmp eax, 0
je 0x529caf
mov eax, dword [ebp - 0xc]
or eax, 0x800000
mov dword [ebp - 0xc], eax
push 4
call dword [sym.imp.USER32.DLL_GetKeyState]
and eax, 0x8000
cmp eax, 0
je 0x529cce
mov eax, dword [ebp - 0xc]
or eax, 0x1000000
mov dword [ebp - 0xc], eax
push 5
call dword [sym.imp.USER32.DLL_GetKeyState]
and eax, 0x8000
cmp eax, 0
je 0x529ced
mov eax, dword [ebp - 0xc]
or eax, 0x400000
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
leave
ret 4
Function at 0x53219d
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.USER32.DLL_ShowWindow]
mov eax, dword [0x583b6c]
xor al, 1
cmp eax, 0
je 0x5321e5
mov eax, dword [ebp + 0xc]
cmp eax, 5
jne 0x5321d4
mov eax, 8
mov dword [ebp + 0xc], 8
push dword [ebp + 0xc]
push 0
push 0
push 0
push dword [ebp + 8]
call fcn.0052ff99
leave
ret 8
Function at 0x539e68
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
sub esp, 0xd0
mov eax, dword [ebp + 0x14]
mov eax, dword [eax]
and eax, 0xff
cmp eax, 0x25
jne 0x539eae
mov eax, dword [ebp + 0x14]
mov eax, dword [eax + 8]
push eax
fild dword [esp]
add esp, 4
fstp dword [ebp - 0xc]
mov eax, dword [ebp + 0x14]
mov eax, dword [eax + 0xc]
push eax
fild dword [esp]
add esp, 4
fstp dword [ebp - 0x10]
jmp 0x539ed5
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0xd4], eax
mov eax, dword [ebp - 0xd4]
fld dword [eax + 4]
fstp dword [ebp - 0xc]
mov eax, dword [ebp - 0xd4]
fld dword [eax + 8]
fstp dword [ebp - 0x10]
mov eax, dword [ebp + 0x14]
add eax, 0x10
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 8]
push eax
fild dword [esp]
add esp, 4
fstp dword [ebp - 0x18]
mov eax, dword [ebp - 0x14]
add eax, 0x10
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 8]
push eax
fild dword [esp]
add esp, 4
fstp dword [ebp - 0x1c]
mov eax, 0
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x28], 0
push 0x3f800000
fld dword [esp]
add esp, 4
fstp dword [ebp - 0x30]
jmp 0x53a033
Function at 0x53ded3
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
sub esp, 0xc
call dword [sym.imp.KERNEL32.DLL_GetCurrentProcessId]
mov dword [0x583a14], eax
push 0
call dword [sym.imp.USER32.DLL_GetDC]
mov dword [0x583a1c], eax
push 0
call dword [sym.imp.KERNEL32.DLL_GetModuleHandleW]
mov dword [0x583a20], eax
mov eax, 0x11c
xchg edx, eax
mov eax, dword [0x583a30]
mov dword [eax], edx
push dword [0x583a30]
call dword [sym.imp.KERNEL32.DLL_GetVersionExW]
mov eax, dword [0x583a30]
mov eax, dword [eax + 4]
cmp eax, 5
jne 0x53df41
mov eax, dword [0x583a30]
mov eax, dword [eax + 8]
cmp eax, 1
jge 0x53df41
jmp 0x53df45
xor eax, eax
jmp 0x53df48
xor eax, eax
inc eax
xor al, 1
cmp eax, 0
je 0x53df56
call fcn.0053dc8c
call fcn.0053ebf3
mov dword [0x583b74], eax
mov eax, dword [0x583a30]
mov eax, dword [eax + 4]
cmp eax, 0xa
setge al
xor ah, ah
cwde
mov dword [0x583b68], eax
mov eax, dword [0x583a30]
mov eax, dword [eax + 4]
cmp eax, 0xa
jge 0x53dfc5
mov eax, dword [0x583a30]
mov eax, dword [eax + 4]
cmp eax, 6
jl 0x53dfb3
mov eax, dword [0x583a30]
mov eax, dword [eax + 8]
cmp eax, 2
jl 0x53dfb3
jmp 0x53dfb7
xor eax, eax
jmp 0x53dfba
xor eax, eax
inc eax
cmp eax, 0
jne 0x53dfc5
xor eax, eax
jmp 0x53dfc8
xor eax, eax
inc eax
mov dword [0x583b6c], eax
mov eax, dword [0x583a30]
mov eax, dword [eax + 4]
cmp eax, 6
setl al
xor ah, ah
cwde
mov dword [0x583b70], eax
push 0x1a
push dword [0x5827a0]
call fcn.0044fe05
mov dword [ebp - 0xc], eax
mov eax, 3
shl eax, 0x13
mov edx, eax
mov eax, 0x27
or eax, edx
mov edx, eax
mov eax, dword [ebp - 0xc]
mov dword [eax], edx
mov eax, dword [0x583a30]
mov eax, dword [eax + 8]
shl eax, 8
xchg edx, eax
mov eax, dword [0x583a30]
mov eax, dword [eax + 4]
or eax, edx
and eax, 0xffff
mov edx, eax
mov eax, dword [ebp - 0xc]
mov dword [eax + 4], edx
call fcn.0053dcd9
mov eax, dword [0x583b70]
xor al, 1
cmp eax, 0
je 0x53e054
call fcn.00525daf
push 0
call fcn.0053da7f
push dword [0x583a20]
call fcn.00528817
push 0x1b
push dword [0x5827a0]
call fcn.0044fe05
mov dword [ebp - 0x10], eax
mov eax, 0xb
xchg edx, eax
mov eax, dword [ebp - 0x10]
mov dword [eax], edx
mov eax, dword [0x583a30]
mov eax, dword [eax + 0xc]
mov edx, eax
mov eax, dword [ebp - 0x10]
mov dword [eax + 8], edx
mov eax, dword [0x583a30]
mov eax, dword [eax + 0xc]
cmp eax, 0x55f0
setge al
xor ah, ah
cwde
mov dword [0x583b64], eax
push 0x1c
push dword [0x5827a0]
call fcn.0044fe05
mov dword [ebp - 0x10], eax
mov eax, 0xb
xchg edx, eax
mov eax, dword [ebp - 0x10]
mov dword [eax], edx
mov eax, dword [0x583a30]
mov al, byte [eax + 0x11a]
and eax, 0xff
mov edx, eax
mov eax, dword [ebp - 0x10]
mov dword [eax + 8], edx
call fcn.0053ddc2
mov eax, dword [0x583b68]
cmp eax, 0
je 0x53e12e
push 0x5867ac
call dword [sym.imp.KERNEL32.DLL_LoadLibraryA]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
cmp eax, 0
je 0x53e12e
push 0x84
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
mov dword [0x583bc4], eax
call fcn.0053e145
mov dword [0x583bc0], eax
push 0x53deb9
call fcn.004a1554
push dword [0x5839d0]
call fcn.00525c62
leave
ret
Function at 0x53e721
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
sub esp, 0x10
push dword [ebp + 8]
call fcn.0053cba5
mov dword [ebp - 0x14], eax
mov eax, 0
mov edx, dword [ebp - 0x14]
cmp eax, edx
jne 0x53e747
jmp 0x53e834
mov eax, dword [ebp + 0xc]
cmp eax, 0xffffffff
jne 0x53e763
push 0
push dword [ebp + 0xc]
push 0xe
push dword [ebp - 0x14]
call dword [sym.imp.USER32.DLL_SendMessageW]
jmp 0x53e776
push 0
push dword [ebp + 0xc]
push 0x149
push dword [ebp - 0x14]
call dword [sym.imp.USER32.DLL_SendMessageW]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
cmp eax, 0
jl 0x53e834
push dword [ebp + 8]
call fcn.00456259
add eax, 0x30
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
and eax, 0xff
cmp eax, 7
je 0x53e7b5
push 2
push dword [ebp - 0x18]
push dword [ebp - 0xc]
call fcn.00447c38
mov eax, dword [ebp - 0x18]
cmp eax, 0
jne 0x53e7cc
push dword [ebp - 0xc]
call fcn.004460b6
jmp 0x53e834
mov eax, dword [ebp - 0x18]
inc eax
shl eax, 2
push eax
push dword [ebp - 0xc]
call fcn.00433262
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0xc]
cmp eax, 0xffffffff
jne 0x53e7fe
push dword [ebp - 0x10]
mov eax, dword [ebp - 0x18]
inc eax
push eax
push 0xd
push dword [ebp - 0x14]
call dword [sym.imp.USER32.DLL_SendMessageW]
jmp 0x53e812
push dword [ebp - 0x10]
push dword [ebp + 0xc]
push 0x148
push dword [ebp - 0x14]
call dword [sym.imp.USER32.DLL_SendMessageW]
xor eax, eax
inc eax
push eax
push dword [ebp - 0xc]
push dword [ebp - 0x18]
push 0
call fcn.0043299b
push dword [0x583258]
push dword [ebp + 8]
push dword [ebp - 0xc]
call fcn.0043951e
leave
ret 8
Function at 0x53e838
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
sub esp, 0x10
mov eax, dword [ebp + 0xc]
cmp eax, 0xffffffff
jne 0x53e861
push 0
push dword [ebp + 0xc]
push 0xe
mov eax, dword [ebp + 8]
mov eax, dword [eax]
push eax
call dword [sym.imp.USER32.DLL_SendMessageW]
jmp 0x53e877
push 0
push dword [ebp + 0xc]
push 0x149
mov eax, dword [ebp + 8]
mov eax, dword [eax]
push eax
call dword [sym.imp.USER32.DLL_SendMessageW]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
cmp eax, 0
jl 0x53e95e
push 3
push dword [ebp + 8]
call fcn.0053ca45
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [eax]
and eax, 0xff
cmp eax, 7
je 0x53e8b3
push 2
push dword [ebp - 0xc]
push dword [ebp - 0x10]
call fcn.00447c38
mov eax, dword [ebp - 0xc]
cmp eax, 0
jne 0x53e8ca
push dword [ebp - 0x10]
call fcn.004460b6
jmp 0x53e95e
mov eax, dword [ebp - 0xc]
inc eax
shl eax, 2
push eax
push dword [ebp - 0x10]
call fcn.00433262
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0xc]
cmp eax, 0xffffffff
jne 0x53e8ff
push dword [ebp - 0x18]
mov eax, dword [ebp - 0xc]
inc eax
push eax
push 0xd
mov eax, dword [ebp + 8]
mov eax, dword [eax]
push eax
call dword [sym.imp.USER32.DLL_SendMessageW]
jmp 0x53e916
push dword [ebp - 0x18]
push dword [ebp + 0xc]
push 0x148
mov eax, dword [ebp + 8]
mov eax, dword [eax]
push eax
call dword [sym.imp.USER32.DLL_SendMessageW]
xor eax, eax
inc eax
push eax
push dword [ebp - 0x10]
push dword [ebp - 0xc]
push 0
call fcn.0043299b
mov eax, dword [ebp + 8]
mov eax, dword [eax]
push eax
call fcn.00528bfd
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
and eax, 0xff
cmp eax, 0x20
jne 0x53e957
push dword [0x583258]
push dword [ebp - 0x14]
push dword [ebp - 0x10]
call fcn.0043951e
push 1
call fcn.0048af86
leave
ret 8

Function at 0x53f0db
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
sub esp, 4
mov eax, dword [0x583a2c]
cmp eax, 0
je 0x53f0f7
call dword [sym.imp.USER32.DLL_ReleaseCapture]
call fcn.0053c2aa
push 0xa
push dword [ebp + 8]
call dword [sym.imp.USER32.DLL_ShowWindow]
push dword [ebp + 8]
call dword [sym.imp.USER32.DLL_UpdateWindow]
mov eax, dword [0x583b6c]
xor al, 1
cmp eax, 0
je 0x53f12e
push 0xffffffffffffffff
push 0
push 0
push 0
push dword [ebp + 8]
call fcn.0052ff99
push dword [ebp + 8]
call dword [sym.imp.USER32.DLL_SetForegroundWindow]
push dword [ebp + 8]
call fcn.0053e57d
leave
ret 4
Function at 0x5410cd
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
sub esp, 4
mov eax, dword [ebp + 0x14]
mov edx, dword [0x582f48]
cmp eax, edx
jne 0x54110a
mov eax, dword [0x583b60]
sub eax, 0xc
push eax
push dword [ebp + 8]
call dword [sym.imp.USER32.DLL_GetWindowLongW]
mov edx, eax
mov eax, 2
and eax, edx
cmp eax, 0
je 0x54110a
jmp 0x54110e
xor eax, eax
jmp 0x541111
xor eax, eax
inc eax
cmp eax, 0
je 0x541135
mov eax, dword [ebp + 0x10]
cmp eax, 0
je 0x54112f
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0053d5f0
jmp 0x541135
call dword [sym.imp.USER32.DLL_DestroyCaret]
mov eax, dword [ebp + 0x10]
cmp eax, 0
je 0x54115a
mov eax, dword [ebp + 0x14]
mov edx, dword [0x582f48]
cmp eax, edx
jne 0x541153
mov eax, 8
jmp 0x541158
mov eax, 5
jmp 0x54115f
mov eax, 0
mov dword [ebp - 0xc], eax
push dword [ebp - 0xc]
push dword [ebp + 8]
call dword [sym.imp.USER32.DLL_ShowWindow]
mov eax, dword [0x583b6c]
xor al, 1
cmp eax, 0
je 0x54118c
push 0xffffffffffffffff
push 0
push 0
push 0
push dword [ebp + 8]
call fcn.0052ff99
mov eax, dword [ebp + 0x14]
mov edx, dword [0x582f74]
cmp eax, edx
jne 0x5411bc
mov eax, dword [0x583b60]
sub eax, 4
push eax
push dword [ebp + 8]
call dword [sym.imp.USER32.DLL_GetWindowLongW]
mov dword [ebp + 8], eax
push dword [ebp - 0xc]
push dword [ebp + 8]
call dword [sym.imp.USER32.DLL_ShowWindow]
mov eax, dword [ebp + 0x14]
mov edx, dword [0x582f64]
cmp eax, edx
jne 0x5411d3
push 9
push dword [ebp + 8]
call fcn.0053225b
leave
ret 0x10
Function at 0x401000
Capabilities:
Encode data using xor

Disassembly:
push ecx
pcmpeqw mm6, mm6
pxor mm7, mm7
push edx
psllw mm6, 0xf
push edi
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov edi, dword [esp + 0x18]
mov eax, dword [esp + 0x1c]
movq mm1, qword [edx]
sub eax, 4
movq mm0, mm1
psrlq mm1, 0x20
jl 0x4010e4
jmp 0x401040
movq mm3, qword [edx + 8]
add edi, 8
punpckldq mm1, mm3
movq mm4, qword [ecx]
paddd mm0, mm1
pxor mm4, mm6
movq mm1, qword [edx + 0x10]
movq mm5, mm4
punpcklwd mm4, mm7
movq mm2, mm3
psrlq mm3, 0x20
paddd mm0, mm2
punpckldq mm3, mm1
psubd mm0, mm4
paddd mm2, mm1
punpckhwd mm5, mm7
paddd mm3, mm2
pslld mm4, 4
psubd mm3, mm5
pslld mm5, 4
psubd mm4, mm0
pcmpeqd mm7, mm7
psubd mm5, mm3
pslld mm7, 0x12
movq mm2, mm6
paddd mm4, mm7
psrld mm2, 0x1c
paddd mm5, mm7
movq mm3, mm2
psrld mm7, 0x1e
pand mm2, mm4
paddd mm4, mm7
psrld mm2, 3
pand mm3, mm5
paddd mm5, mm7
psrld mm3, 3
paddd mm4, mm2
paddd mm5, mm3
psrad mm4, 3
add edx, 0x10
psrad mm5, 3
add ecx, 8
packssdw mm4, mm5
movq mm0, mm1
pxor mm7, mm7
psrlq mm1, 0x20
sub eax, 4
movq qword [edi - 8], mm4
jge 0x401040
add eax, 4
jle 0x401185
movq mm3, qword [edx + 8]
punpckldq mm1, mm3
movq mm4, qword [ecx]
paddd mm0, mm1
pxor mm4, mm6
movq mm1, qword [edx + 0x10]
movq mm5, mm4
punpcklwd mm4, mm7
movq mm2, mm3
psrlq mm3, 0x20
paddd mm0, mm2
punpckldq mm3, mm1
psubd mm0, mm4
paddd mm2, mm1
punpckhwd mm5, mm7
pcmpeqd mm7, mm7
paddd mm3, mm2
pslld mm4, 4
psubd mm3, mm5
pslld mm5, 4
psubd mm4, mm0
pslld mm7, 0x12
psubd mm5, mm3
psrld mm6, 0x1c
paddd mm4, mm7
movq mm0, mm6
paddd mm5, mm7
psrld mm7, 0x1e
pand mm6, mm4
paddd mm4, mm7
psrld mm6, 3
pand mm0, mm5
paddd mm5, mm7
psrld mm0, 3
paddd mm4, mm6
paddd mm5, mm0
psrad mm4, 3
psrad mm5, 3
packssdw mm4, mm5
cmp eax, 2
jl 0x40117f
movd dword [edi], mm4
je 0x401185
psrlq mm4, 0x20
add edi, 4
movd edx, mm4
mov word [edi], dx
emms
pop edi
pop edx
pop ecx
ret

Function at 0x40d0c1
Capabilities:
Encode data using xor

Disassembly:
sal esi, 1
adc ecx, dword [ebp - 0x9ee4857]
in eax, 0x3b
in al, 0x72
mov ebx, 0x16a8020b
aam 0x11
mov bl, 0x7a
xor al, 0xf4
push eax
xor dword [edx - 7], eax
xchg esp, eax
push edi
xor al, 0xe6
invalid
Function at 0x499cf0
Capabilities:
Encode data using xor

Disassembly:
invalid
jbe 0x499cd2
sbb dword [eax + edi*2 - 4], 0x22
lcall 0x4f60, 0x7dc1438a
loopne 0x499c84
ror byte [esi + edx*4 + 0x220d110], cl
jnp 0x499c78
push edi
adc bh, byte [eax - 0x27492f1e]
not dword [edx]
mov eax, 0xd8b6d0e2
loop 0x499c70
pop ecx
jecxz 0x499c9d
sbb byte [eax], dh
mov dh, 0xa0
adc dword [edx], 0xb08fa48e
outsd dx, dword [esi]
add dword [ebx], edx
cmp byte [edx], bh
jbe 0x499cea
xor byte [esi - 0x71ed7e60], dh
movsb byte es:[edi], byte [esi]
invalid
movsd dword es:[edi], dword [esi]
adc byte [edx + esi*2], 0xba
imul byte [edx + 0x7d]
jge 0x499ca0
add ch, byte [ebx + 0x11]
imul edx, dword [ecx], 0x6c
insb byte es:[edi], dx
test bh, bh
pop ss
push ebx
inc edi
fnstenv [ebx + 0x21f65cdc]
xchg esi, eax
mov dl, byte [edi - 0x76974fef]
cmpsd dword [esi], dword es:[edi]
shr dh, 0x97
jo 0x499c58
sub dword [esi - 0x2059e40f], esi
jne 0x499d22
scasb al, byte es:[edi]
add edi, dword [ebx]
xchg edi, eax
loope 0x499c60
xor eax, 0x4f92ad7
cmp byte [edi - 0x2693a471], 0x47
inc edi
outsb dx, byte [esi]
outsd dx, dword [esi]
jl 0x499d27
and dword [0x70b905f1], edi
xlatb
fnstenv [edx + ebp - 0x2d]
sti
mov bl, byte [eax]
aam 0x1d
cld
inc ebp
fucom st(1)
pop ebp
adc eax, 0x762dc3b1
sub eax, 0x3f52ba76
salc
outsd dx, dword [esi]
sub eax, 0x3f52ba76
salc
outsd dx, dword [esi]
sub byte [edi + 0x26b9ccb2], cl
mov ecx, 0xc0869e3d
sbb ch, byte [esi - 0x4eae2943]
inc eax
scasb al, byte es:[edi]
mov ebp, 0x40b151d6
push ebx
les ecx, [esi]
dec edx
sub al, 0x61
mov ebx, 0x380d29
ja 0x499d22
scasb al, byte es:[edi]
xchg esi, eax
jo 0x499d6a
jl 0x499c9c
cmp dword [ebx], edi
insd dword es:[edi], dx
invalid
in al, dx
movsb byte es:[edi], byte [esi]
dec edi
movsd dword es:[edi], dword [esi]
xor byte [ecx + 0x6b], 0x91
jno 0x499d94
xchg ecx, eax
push 0x54
jp 0x499d25
mov esp, 0x5b367f96
pop eax
retf
add dword [edx + 0x27ba1e88], ebp
outsb dx, byte [esi]
and dword [ebx + 0xd9b7c4b], ebx
jb 0x499d03
cmpsb byte [esi], byte es:[edi]
pop edx
pushal
cli
shl dword [ecx], 0x9e
daa
pop esi
add byte [esi + 0x62], bl
leave
add byte [ecx - 0x5c], 0x83
adc cl, byte [ebx - 0x45fd9632]
add dh, byte [edi - 0x459da5fe]
sbb byte [edx + 0x57438dea], 0xd2
pop ds
bound edi, qword [edx - 0x7215657e]
inc ebx
push edi
rcr byte [edi], cl
daa
sahf
out 0x6a, eax
invalid
Function at 0x606a5d
Capabilities:
Encode data using xor

Disassembly:
add al, byte [ebx - 0x60]
cmc
cmpsd dword [esi], dword es:[edi]
adc dword [eax + 0x4e], 0x60
stosd dword es:[edi], eax
fcomp dword [esi + 0x7c3f3f9d]
inc edx
sub dword [eax + 0x3b177930], ebx
daa
pushal
insb byte es:[edi], dx
and esi, edi
push ecx
test al, 0x13
pushfd
push 0x6d
loop 0x606a97
fbld tbyte [ecx + 0x32af5a2c]
cmp byte [edi], 0x36
inc ebp
sbb dword [ebp + 0x6c], esp
outsb dx, byte [esi]
and dh, byte [edi + edx*4 - 0x8d78c06]
pushal
mul dword [eax + 0x24]
push eax
and al, 0x50
xor dword [edi + edi*4 - 0x43], esi
xor byte [ebp + 0x7ef13a08], dl
sbb dword [ebx], ebp
sar byte [eax + 0x18b795e4], 0x13
dec edx
jnp 0x606a95
sub al, 0x58
in eax, dx
shl byte [edi - 0x35], cl
push edi
cmp eax, 0x7652f8f9
pop ss
call [edx + edi*8]
jnp 0x606ac3
xchg dword [ebx + 0x1b6c0251], ecx
adc al, 0xf2
sub dword [ebp + 0x7e], 0xffffffb1
push ecx
add ch, byte [ebx + ebx + 0x14]
sub dword [ebp + 0x7e], 0xffffffb1
adc cl, byte [edi + 0x6e70cd98]
mov esp, 0x68634fe1
mov byte fs:[ebx], bl
std
dec edx
mov eax, 0x6f882436
xor ch, byte [ebp + 0x24]
invalid

Function at 0x622cb5
Capabilities:
Encode data using xor

Disassembly:
cdq
nop
xchg edi, eax
outsd dx, dword [esi]
pop edx
pop ecx
cmpsb byte [esi], byte es:[edi]
outsd dx, dword [esi]
inc ecx
xor ebp, dword [edi + ebp*8 - 0x689c3b68]
stc
cmp esi, esp
sbb eax, 0x5397850c
or dword [ebx - 0x4ea56b7b], ebx
xchg edi, eax
popal
jge 0x622d01
cmp al, 0xed
insb byte es:[edi], dx
jne 0x622d33
cmp ah, ah
popal
sbb al, 0xa0
jp 0x622d1e
in al, 0x88
xchg edi, eax
mov ch, 0xd9
insd dword es:[edi], dx
adc dh, 0xc
cld
pop es
pushfd
or edi, esi
cld
xor esi, dword [ebx]
mov dword [0x8bedcdc7], eax
jo 0x622ce4
enter 0x12, 0x10
scasd eax, dword es:[edi]
ret
xchg esp, eax
shl ebp, 1
cmp byte [esi], bh
mov al, byte [0xe909bae9]
int3
outsb dx, byte [esi]
invalid

Function at 0x627cc9
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x630398
cmp edx, dword [eax]
je 0x627ceb
add eax, 8
inc ecx
cmp eax, 0x630428
jl 0x627cdc
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x630398]
jne 0x627e19
mov eax, dword [0x639d20]
cmp eax, 1
je 0x627df3
test eax, eax
jne 0x627d1c
cmp dword [0x6302c0], 1
je 0x627df3
cmp edx, 0xfc
je 0x627e19
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x627d53
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.006286b0
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.00628b40
inc eax
pop ecx
cmp eax, 0x3c
jbe fcn.00627d96
lea eax, [ebp - 0x1a4]
push eax
call fcn.00628b40
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x62ca34
push edi
call fcn.0062aa10
add esp, 0x10
lea eax, [ebp + 8]
lea esi, [esi + 0x63039c]
push 0
push eax
push dword [esi]
call fcn.00628b40
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
Function at 0x100b05f0
Capabilities:
Packed with generic packer

Disassembly:
cmp byte [esp + 8], 1
jne 0x100b07bd
pushal
mov esi, section.UPX1
lea edi, [esi - 0x7b000]
push edi
or ebp, 0xffffffff
jmp 0x100b061a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x100b0621
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x100b0610
mov eax, 1
add ebx, ebx
jne 0x100b0633
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x100b0628
jne 0x100b0644
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x100b0628
xor ecx, ecx
sub eax, 3
jb 0x100b0658
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x100b06ca
mov ebp, eax
add ebx, ebx
jne 0x100b0663
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x100b0670
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x100b0694
inc ecx
add ebx, ebx
jne 0x100b0680
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x100b0675
jne 0x100b0691
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x100b0675
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x100b06b4
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x100b06a5
jmp 0x100b0616
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x100b06b4
add edi, ecx
jmp 0x100b0616
pop esi
mov edi, esi
mov ecx, 0x32bc
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x100b06d2
cmp byte [edi], 0x21
jne 0x100b06d2
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x100b06d7
lea edi, [esi + 0xab000]
mov eax, dword [edi]
or eax, eax
je 0x100b074f
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xb0000]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xb012c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x100b0704
mov ecx, edi
jns 0x100b0733
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xb0130]
or eax, eax
je 0x100b0749
mov dword [ebx], eax
add ebx, 4
jmp 0x100b0721
popal
xor eax, eax
ret 0xc
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x100b0780
cmp al, 0xef
ja 0x100b0773
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x100b0755
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x100b0762
mov ebp, dword [esi + 0xb0134]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x237]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x100b07b4
sub esp, 0xffffff80
jmp 0x1005b375
Function at 0x42e003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
call 0x42e00c
nop
nop
nop
nop
nop
pop eax
nop
add eax, 0x403ac5
sub eax, 0x403a6b
nop
nop
nop
nop
nop
mov ebx, dword [eax]
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
jl 0x42e030
nop
nop
add eax, 0xc
nop
nop
nop
nop
nop
nop
cmp dword [eax], 0
nop
jne 0x42e01e
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp loc.00401219