joyce8/EMBER2024-capa huggingface dataset:
Function at 0x433002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
call 0x43300c
nop
nop
nop
nop
pop eax
nop
add eax, 0x40a063
nop
sub eax, 0x40a009
nop
nop
nop
nop
mov ebx, dword [eax]
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
jl 0x433030
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
jne 0x43301e
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x431219
Function at 0x401869
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
pushal
call 0x401878
pop dword [ebp - 0x34]
mov eax, 0x401878
sub dword [ebp - 0x34], eax
push 0x40
push 0x1000
push 0x4d970
push 0
mov eax, 0x19531075
add eax, 0xe6f35763
add eax, dword [ebp - 0x34]
call dword [eax]
mov ecx, 0x479a
xor edx, edx
add edx, eax
mov ebx, 0xa0947cd9
sub ebx, 0xa04b9cd9
add ebx, dword [ebp - 0x34]
mov esi, 0x6b35533e
sub esi, 0xf55a1702
xor dword [ebp - 0x14], 0xaf5592de
mov edi, dword [ebx]
xor dword [ebp - 0x18], 0x8352ea7c
sub edi, esi
xor dword [ebp - 0x20], 0xe87ff3e0
mov dword [edx], edi
add dword [ebp - 0xc], 0x2b88e6ad
add edx, 4
add ebx, 0x2416cec6
add ebx, 0xdbe9313e
loop 0x4018ce
add eax, 0x1113b
xor ebx, ebx
add ebx, eax
add eax, 0x3b74b023
add eax, 0xc48b4fe2
mov ecx, 0x9eabafb3
sub ecx, 0x9e6bafb3
add ecx, dword [ebp - 0x34]
call ebx
leave
ret
Function at 0x401016
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
je 0x4010a6
push ebp
mov ebp, dword [esp + 0x14]
push edi
mov edi, dword [esp + 0x10]
push ebx
cmp byte [esi], 0
je 0x4010a3
push 0x5c
push esi
call dword [sym.imp.MSVCR80.dll_strchr]
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x4010a3
push edi
mov byte [esi], 0
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x40107c
push 0
push edi
call dword [sym.imp.kernel32.dll_CreateDirectoryA]
test eax, eax
jne 0x401075
test ebp, ebp
je 0x401075
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
jmp 0x40107c
push edi
push 1
call ebp
pop ecx
pop ecx
test bl, 0x10
jne 0x40109d
push 0xb7
call dword [sym.imp.kernel32.dll_SetLastError]
test ebp, ebp
je 0x40109d
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
mov byte [esi], 0x5c
inc esi
jne 0x40102e
pop ebx
pop edi
pop ebp
xor eax, eax
inc eax
pop esi
ret

Function at 0x401bc8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
pushal
call 0x401bd7
pop dword [ebp - 0x50]
mov eax, 0x401bd7
sub dword [ebp - 0x50], eax
mov dword [ebp - 0x60], 0x6a33bb25
add dword [ebp - 0x60], 0xe41e8a26
mov dword [ebp - 0x5c], 0x107f9baf
add dword [ebp - 0x5c], 0x21b3b096
mov dword [ebp - 0x58], 0x78b64349
add dword [ebp - 0x58], 0xd39600e5
mov dword [ebp - 0x54], 0x41554d8d
sub dword [ebp - 0x54], 0x41554d8d
lea eax, [ebp - 0x60]
push eax
mov eax, 0x33a862a5
sub eax, 0x3367f245
add eax, dword [ebp - 0x50]
call dword [eax]
mov dword [ebp - 0x60], 0xfbec899a
sub dword [ebp - 0x60], 0x877a2044
mov dword [ebp - 0x5c], 0x6519b6bb
sub dword [ebp - 0x5c], 0x23ad5546
mov dword [ebp - 0x58], 0x5d7ae5dc
sub dword [ebp - 0x58], 0xfa0b7970
mov dword [ebp - 0x54], 0x2110793e
sub dword [ebp - 0x54], 0x2110793e
lea ebx, [ebp - 0x60]
push ebx
push eax
mov eax, 0x8888a172
add eax, 0x77b7cf8e
add eax, dword [ebp - 0x50]
call dword [eax]
push 0x40
push 0x1000
push 0x3ca23
push 0
call eax
mov ecx, 0xa6002cb
add ecx, 0xf5a05d71
mov esi, eax
mov edi, 0xaa36f750
sub edi, 0xa9f5f750
add edi, dword [ebp - 0x50]
mov ebx, 0x4e293590
xor dword [ebp - 0x1c], 0x191cbbb3
mov edx, dword [edi]
xor dword [ebp - 4], 0x177a0474
xor edx, ebx
sub dword [ebp - 0x4c], 0xa146f2e8
mov dword [esi], edx
xor dword [ebp - 0x38], 0x5ff1ce73
add esi, 0x2ac13025
add esi, 0xd53ecfdf
add edi, 4
loop 0x401cee
add eax, 0x5c48c6a1
add eax, 0xa3b8ad22
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x400000
add ecx, dword [ebp - 0x50]
call ebx
leave
ret
Function at 0x100163f0
Capabilities:
Get number of processors

Disassembly:
inc ebx
pop ecx
mov ecx, dword [ebp - 0x3f0]
mov dword [ebp - 0x4fc], ecx
jmp 0x10016410
mov edx, dword [ebp - 0x4fc]
add edx, 1
mov dword [ebp - 0x4fc], edx
push ecx
sub ecx, 0x1d8b
and ecx, 0xd5ad
jmp 0x10016422
or ecx, 0x387d
pop ecx
push edx
push eax
add esp, 4
call 0x1001643e
add byte [0x37364942], dh
dec esp
dec ecx
cmp dword [eax + 0x3e], ecx
add esp, 4
pop edx
mov eax, dword [ebp - 0x4fc]
sub eax, dword [ebp - 0x3f0]
cmp eax, 0xffffffff
jb 0x1001648a
push eax
push ecx
add esp, 4
and eax, 0xdcb
xor eax, 0x12ac8
pop eax
push edi
push ebx
add esp, 4
xor edi, 0x2f3d
xor edi, 0x12ba8
pop edi
push ebx
add ebx, 0xb2df
and ebx, 0x1195d
pop ebx
jmp 0x100166b8
mov dword [ebp - 0xc80], 7
mov ecx, dword [ebp - 0x4fc]
mov dword [ebp - 0xac4], ecx
push eax
push ecx
add esp, 4
xor eax, 0x9a12
add eax, 0x4432
xor eax, 0xaba5
pop eax
push edx
push edx
add esp, 4
or edx, 0x2aad
sub edx, 0x86d3
pop edx
push edx
sub edx, 0x752e
pop edx
mov edx, dword [ebp - 0x15c4]
mov dword [ebp - 0xa60], edx
mov dword [ebp - 0xc84], 0
mov eax, dword [ebp - 0x4fc]
cmp eax, dword [ebp - 0x15c4]
jne 0x10016539
push edx
push edi
add esp, 4
and edx, 0x12bd4
jmp 0x10016506
jmp 0x1001650d
pop edx
push ecx
push ebx
add esp, 4
sub ecx, 0xd856
pop ecx
push edx
sub edx, 0x9c68
sub edx, 0x12696
pop edx
mov ecx, dword [ebp - 0xc84]
mov dword [ebp - 0x15cc], ecx
jmp 0x1001666a
cmp dword [ebp - 0xc80], 0
jle 0x1001665e
push edi
push eax
add esp, 4
xor edi, 0xf541
or edi, 0xba6f
and edi, 0xbb3
pop edi
push ecx
or ecx, 0x14bde
add ecx, 0x13576
xor ecx, 0x4aca
xor ecx, 0x9c73
pop ecx
mov edx, dword [ebp - 0xac4]
movzx eax, byte [edx]
mov ecx, dword [ebp - 0xa60]
movzx edx, byte [ecx]
cmp eax, edx
je 0x100165fa
push edi
xor edi, 0xff69
imul dword [ecx - 1]
add byte [eax], al
add edi, 0x9f4c
pop edi
push edx
push eax
add esp, 4
sub edx, 0x5cc1
or edx, 0x12954
call 0x100165bc
add byte [ecx + 0x4d], cl
inc ecx
dec ebp
cmp eax, 0x4b384c43
add esp, 4
pop edx
mov eax, dword [ebp - 0xac4]
movzx ecx, byte [eax]
mov edx, dword [ebp - 0xa60]
movzx eax, byte [edx]
cmp ecx, eax
jle 0x100165e2
mov dword [ebp - 0x15c8], 1
jmp 0x100165ec
mov dword [ebp - 0x15c8], 0xffffffff
mov ecx, dword [ebp - 0x15c8]
mov dword [ebp - 0xc84], ecx
jmp 0x1001665e
push esi
and esi, 0x162a6
call 0x10016610
add byte [ecx], bh
inc edx
dec ecx
inc ecx
cmp al, 0x34
cmp al, 0x45
xor eax, dword [ebx + 0x7eb04c4]
aaa
inc edi
dec ebp
aaa
inc ebp
cmp esi, dword [ebx]
add esi, 0x8cb2
pop esi
push ecx
jmp 0x1001662b
pop ecx
mov edx, dword [ebp - 0xc80]
sub edx, 1
mov dword [ebp - 0xc80], edx
mov eax, dword [ebp - 0xac4]
add eax, 1
mov dword [ebp - 0xac4], eax
mov ecx, dword [ebp - 0xa60]
add ecx, 1
mov dword [ebp - 0xa60], ecx
jmp 0x10016539
mov edx, dword [ebp - 0xc84]
mov dword [ebp - 0x15cc], edx
cmp dword [ebp - 0x15cc], 0
jne 0x100166b3
push esi
and esi, 0xa6c3
jmp 0x1001667f
add esi, 0xed04
or esi, 0xa268
pop esi
push edi
push esi
invalid
invalid
Function at 0x1001643e
Capabilities:
Get number of processors

Disassembly:
inc ebx
pop ecx
mov ecx, dword [ebp - 0x3f0]
mov dword [ebp - 0x4fc], ecx
jmp 0x10016410
mov edx, dword [ebp - 0x4fc]
add edx, 1
mov dword [ebp - 0x4fc], edx
push ecx
sub ecx, 0x1d8b
and ecx, 0xd5ad
jmp 0x10016422
or ecx, 0x387d
pop ecx
push edx
push eax
add esp, 4
call 0x1001643e
add byte [0x37364942], dh
dec esp
dec ecx
cmp dword [eax + 0x3e], ecx
add esp, 4
pop edx
mov eax, dword [ebp - 0x4fc]
sub eax, dword [ebp - 0x3f0]
cmp eax, 0xffffffff
jb 0x1001648a
push eax
push ecx
add esp, 4
and eax, 0xdcb
xor eax, 0x12ac8
pop eax
push edi
push ebx
add esp, 4
xor edi, 0x2f3d
xor edi, 0x12ba8
pop edi
push ebx
add ebx, 0xb2df
and ebx, 0x1195d
pop ebx
jmp 0x100166b8
mov dword [ebp - 0xc80], 7
mov ecx, dword [ebp - 0x4fc]
mov dword [ebp - 0xac4], ecx
push eax
push ecx
add esp, 4
xor eax, 0x9a12
add eax, 0x4432
xor eax, 0xaba5
pop eax
push edx
push edx
add esp, 4
or edx, 0x2aad
sub edx, 0x86d3
pop edx
push edx
sub edx, 0x752e
pop edx
mov edx, dword [ebp - 0x15c4]
mov dword [ebp - 0xa60], edx
mov dword [ebp - 0xc84], 0
mov eax, dword [ebp - 0x4fc]
cmp eax, dword [ebp - 0x15c4]
jne 0x10016539
push edx
push edi
add esp, 4
and edx, 0x12bd4
jmp 0x10016506
jmp 0x1001650d
pop edx
push ecx
push ebx
add esp, 4
sub ecx, 0xd856
pop ecx
push edx
sub edx, 0x9c68
sub edx, 0x12696
pop edx
mov ecx, dword [ebp - 0xc84]
mov dword [ebp - 0x15cc], ecx
jmp 0x1001666a
cmp dword [ebp - 0xc80], 0
jle 0x1001665e
push edi
push eax
add esp, 4
xor edi, 0xf541
or edi, 0xba6f
and edi, 0xbb3
pop edi
push ecx
or ecx, 0x14bde
add ecx, 0x13576
xor ecx, 0x4aca
xor ecx, 0x9c73
pop ecx
mov edx, dword [ebp - 0xac4]
movzx eax, byte [edx]
mov ecx, dword [ebp - 0xa60]
movzx edx, byte [ecx]
cmp eax, edx
je 0x100165fa
push edi
xor edi, 0xff69
imul dword [ecx - 1]
add byte [eax], al
add edi, 0x9f4c
pop edi
push edx
push eax
add esp, 4
sub edx, 0x5cc1
or edx, 0x12954
call 0x100165bc
add byte [ecx + 0x4d], cl
inc ecx
dec ebp
cmp eax, 0x4b384c43
add esp, 4
pop edx
mov eax, dword [ebp - 0xac4]
movzx ecx, byte [eax]
mov edx, dword [ebp - 0xa60]
movzx eax, byte [edx]
cmp ecx, eax
jle 0x100165e2
mov dword [ebp - 0x15c8], 1
jmp 0x100165ec
mov dword [ebp - 0x15c8], 0xffffffff
mov ecx, dword [ebp - 0x15c8]
mov dword [ebp - 0xc84], ecx
jmp 0x1001665e
push esi
and esi, 0x162a6
call 0x10016610
add byte [ecx], bh
inc edx
dec ecx
inc ecx
cmp al, 0x34
cmp al, 0x45
xor eax, dword [ebx + 0x7eb04c4]
aaa
inc edi
dec ebp
aaa
inc ebp
cmp esi, dword [ebx]
add esi, 0x8cb2
pop esi
push ecx
jmp 0x1001662b
pop ecx
mov edx, dword [ebp - 0xc80]
sub edx, 1
mov dword [ebp - 0xc80], edx
mov eax, dword [ebp - 0xac4]
add eax, 1
mov dword [ebp - 0xac4], eax
mov ecx, dword [ebp - 0xa60]
add ecx, 1
mov dword [ebp - 0xa60], ecx
jmp 0x10016539
mov edx, dword [ebp - 0xc84]
mov dword [ebp - 0x15cc], edx
cmp dword [ebp - 0x15cc], 0
jne 0x100166b3
push esi
and esi, 0xa6c3
jmp 0x1001667f
add esi, 0xed04
or esi, 0xa268
pop esi
push edi
push esi
invalid
invalid
Function at 0x10021810
Capabilities:
Encode data using xor

Disassembly:
cwde
push ecx
add al, byte [edx]
and ebp, 0x11
push eax
add al, byte [edx]
pop ebp
pop eax
push esp
test esi, eax
push es
adc eax, 0x69
add al, byte [edx]
add al, byte [ebx + 0x32ef0c8]
add ah, byte [eax + 0x66]
mov dword [0x202021a], eax
mov eax, dword [edi + 0x101e6da]
lea ecx, [edi + 0x101e6da]
lea edx, [ebx + 0x32]
mov edx, dword [edi + 0x101e6d6]
lea eax, [edi + 0x101e6d6]
mov eax, dword [edi + 0x101ef76]
pop ecx
cmp ecx, 4
aaa
add eax, dword [edx]
xor ecx, 0xffffff93
dec eax
add eax, dword [edx]
xor ecx, 0x45
adc al, byte [edx]
add ah, byte [ecx + 0x54]
pop eax
test esi, eax
push es
xor esp, 0x5d
push 0xec830202
cmp byte [ecx], cl
add al, byte [edx]
Function at 0x53c980
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0xf5000]
push edi
jmp 0x53c99a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x53c9a1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x53c990
mov eax, 1
add ebx, ebx
jne 0x53c9b3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x53c9c4
jne 0x53c9e3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x53c9e3
dec eax
add ebx, ebx
jne 0x53c9d0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x53c9a8
add ebx, ebx
jne 0x53c9df
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x53ca35
xor ecx, ecx
sub eax, 3
jb 0x53c9fb
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x53ca6a
sar eax, 1
mov ebp, eax
jmp 0x53ca06
add ebx, ebx
jne 0x53ca06
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x53c9d4
inc ecx
add ebx, ebx
jne 0x53ca14
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x53c9d4
add ebx, ebx
jne 0x53ca21
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x53ca16
jne 0x53ca32
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x53ca16
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x53ca54
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x53ca46
jmp 0x53c996
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x53ca54
add edi, ecx
jmp 0x53c996
pop esi
mov edi, esi
mov ecx, 0x32e4
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x53ca72
cmp byte [edi], 0xd
jne 0x53ca72
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x53ca77
lea edi, [esi + 0x139000]
mov eax, dword [edi]
or eax, eax
je 0x53caef
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x13d618]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x13d6b8]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x53caa4
mov ecx, edi
jns 0x53cad3
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x13d6bc]
or eax, eax
je 0x53cae9
mov dword [ebx], eax
add ebx, 4
jmp 0x53cac1
call dword [esi + 0x13d6cc]
mov ebp, dword [esi + 0x13d6c0]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x31f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x53cb23
sub esp, 0xffffff80
jmp 0x401320
Function at 0x2a806b7f
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
pushal
call 0x2a806b8e
pop dword [ebp - 0x1c]
mov eax, 0xd32380cf
add eax, 0x575ceabf
sub dword [ebp - 0x1c], eax
mov dword [ebp - 0x2c], 0xe165aaea
add dword [ebp - 0x2c], 0x6cec9a61
mov dword [ebp - 0x28], 0xdbc6081d
add dword [ebp - 0x28], 0x566d4428
mov dword [ebp - 0x24], 0x57b09990
sub dword [ebp - 0x24], 0xb645562
mov dword [ebp - 0x20], 0x430debf5
sub dword [ebp - 0x20], 0x430debf5
lea eax, [ebp - 0x2c]
push eax
mov eax, 0x5a808719
add eax, 0xd0049a2b
add eax, dword [ebp - 0x1c]
call dword [eax]
mov dword [ebp - 0x2c], 0x878953c7
add dword [ebp - 0x2c], 0xece9158f
mov dword [ebp - 0x28], 0x3ca5e8ac
sub dword [ebp - 0x28], 0xfb398737
mov dword [ebp - 0x24], 0xc90fcf26
add dword [ebp - 0x24], 0x9a5f9d46
mov dword [ebp - 0x20], 0xf7d835a
sub dword [ebp - 0x20], 0xf7d835a
lea ebx, [ebp - 0x2c]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x1c]
call dword [eax]
push 0x40
push 0x1000
push 0x49704
push 0
call eax
mov ecx, 0x4846b00a
sub ecx, 0x48466b01
mov edi, eax
mov edx, 0x7a7cdbf6
sub edx, 0x4ff4f1f6
add edx, dword [ebp - 0x1c]
mov esi, 0x5b81a29b
add esi, 0xd71a01d0
add dword [ebp - 0x10], 0x77a8f3c8
mov ebx, dword [edx]
add dword [ebp - 0x18], edi
xor ebx, esi
add dword [ebp - 8], 0xa10161c9
mov dword [edi], ebx
xor dword [ebp - 8], 0x55b99d4e
add edi, 4
add edx, 0x6ba3b11
sub edx, 0x6ba3b0d
loop 0x2a806cab
add eax, 0x85509ab7
sub eax, 0x854f93c0
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x2a800000
add ecx, dword [ebp - 0x1c]
call ebx
leave
ret

Function at 0x2a80c4de
Capabilities:
Check for time delay via gettickcount

Disassembly:
push esi
call dword [sym.imp.kernel32.dll_GetTickCount]
mov esi, eax
shr esi, 4
call dword [sym.imp.kernel32.dll_GetTickCount]
shr eax, 4
sub eax, esi
cmp eax, 0xc
jbe 0x2a80c4ea
pop esi
ret
Function at 0x4069c5
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x23c
push esi
mov esi, 0x104
lea eax, [ebp - 0x23c]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
cmp eax, esi
pop esi
jbe 0x4069e9
xor eax, eax
test eax, eax
je 0x4069fc
cmp word [ebp + eax*2 - 0x23e], 0x5c
je 0x4069fc
xor ecx, ecx
jmp 0x4069ff
xor ecx, ecx
inc ecx
push dword [ebp + 8]
lea ecx, [ecx*2 + 0x40a014]
lea eax, [ebp + eax*2 - 0x23c]
push ecx
push str._s_S.dll
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea eax, [ebp - 0x23c]
push 8
push 0
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
leave
ret 4

Function at 0x406b22
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x427dec], 0
push esi
jne 0x406b59
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x406b33
mov dword [ecx*4 + 0x427de8], eax
inc ecx
cmp ecx, 0x100
jl 0x406b2e
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x406b8a
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x427de8]
xor eax, esi
inc ecx
dec edx
jne 0x406b6c
pop edi
not eax
pop esi
ret 0xc

Function at 0x433005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
call 0x43300c
nop
pop eax
nop
nop
nop
nop
add eax, 0x40a063
nop
sub eax, 0x40a009
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
nop
jl 0x433030
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
nop
jne 0x43301e
nop
nop
nop
nop
nop
nop
popal
jmp 0x431219
Function at 0x4278c0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x1c000]
push edi
jmp 0x4278da
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x4278e1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4278d0
mov eax, 1
add ebx, ebx
jne 0x4278f3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x4278e8
jne 0x427904
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4278e8
xor ecx, ecx
sub eax, 3
jb 0x427918
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x42798a
mov ebp, eax
add ebx, ebx
jne 0x427923
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x427930
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x427954
inc ecx
add ebx, ebx
jne 0x427940
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x427935
jne 0x427951
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x427935
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x427974
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x427965
jmp 0x4278d6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x427974
add edi, ecx
jmp 0x4278d6
pop esi
lea edi, [esi + 0x19000]
mov ecx, 2
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x427996
cmp byte [edi], 0
jne 0x427996
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x42799b
lea edi, [esi + 0x25000]
mov eax, dword [edi]
or eax, eax
je 0x427a0a
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x27000]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x27028]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x4279c8
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x27030]
or eax, eax
je 0x427a04
mov dword [ebx], eax
add ebx, 4
jmp 0x4279e5
call dword [esi + 0x2702c]
mov ebp, dword [esi + 0x27034]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1ef]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x427a3e
sub esp, 0xffffff80
jmp 0x4038fc
Function at 0x401000
Capabilities:
Accept command line arguments
Query environment variable

Disassembly:
jmp 0x401012
mov eax, dword [0x41111b]
shl eax, 2
mov dword [0x41111f], eax
push edx
push 0
call sub.KERNEL32.DLL_GetModuleHandleA
mov edx, eax
call fcn.00406990
pop edx
call fcn.00405d2c
call fcn.00406994
push 0
call fcn.00407640
pop ecx
push 0x4110c4
push 0
call sub.KERNEL32.DLL_GetModuleHandleA
mov dword [0x411123], eax
push 0
jmp fcn.0040e224

Function at 0x40583b
Capabilities:
Encode data using xor

Disassembly:
push esp
adc byte [edx], dh
retf
fld xword [0xfb55b0f0]
sub ebx, ebx
cmp eax, 0x78eedbcd
mov bh, 0x11
outsd dx, dword [esi]
push 0x4752d34b
push eax
sbb dl, byte [ecx]
jns 0x405877
pop ebx
cmp eax, 0x89025bf6
mov ch, 0x81
bound esi, qword [ecx + 0x60]
loopne 0x405868
insd dword es:[edi], dx
inc eax
js 0x4058c3
aaa
retf 0x378
js 0x40586d
mov dl, 0xa8
invalid
fstp qword [ebx]
int3
sti
xchg esi, eax
xor al, 0x29
or al, 6
lodsb al, byte [esi]
mov edi, 0xff639db5
loope 0x4058ea
sub eax, dword [ecx + ecx]
pop eax
jo 0x40581e
inc edx
xlatb
sub esi, ecx
dec esp
xchg dword [esi], ebx
wait
xor bl, byte [esi]
and dh, byte [eax + 0x4c59c686]
out 0x15, eax
fsqrt
das
jle 0x40588d
cmp dword [edi - 0xd21a542], ebx
mov esi, 0x360501a7
push edi
jecxz 0x4058c4
pushal
and al, 0xc4
adc al, 0x87
cmpsb byte [esi], byte es:[edi]
dec eax
adc eax, 0xc197905d
shl dword [esi], 1
add eax, 0xb7b54b62
mov bh, 0xb5
add dl, al
lahf
xchg edi, eax
adc byte [ebp - 0x75], 0xec
mov ch, 2
rcr byte [edi + 0x55809736], 1
mov ebp, esp
pop ebp
ret
ret 0x85ff

Function at 0x406684
Capabilities:
Get memory capacity

Disassembly:
add esp, 0xffffffe0
mov dword [esp], 0x20
push esp
call sub.KERNEL32.DLL_GlobalMemoryStatus
mov eax, dword [esp + 0xc]
add esp, 0x20
ret
Function at 0x1000ecef
Capabilities:
Hash data using djb2

Disassembly:
push esi
mov esi, ecx
test esi, esi
jne 0x1000ecfb
or eax, 0xffffffff
pop esi
ret
movzx eax, word [esi]
push ebx
push edi
mov edi, 0x1505
xor ebx, ebx
jmp 0x1000ed23
movzx ecx, ax
add eax, 0xffffffbf
cmp ax, 0x19
lea edx, [ecx + 0x20]
cmova edx, ecx
imul edi, edi, 0x21
xor edi, edx
inc ebx
movzx eax, word [esi + ebx*2]
test ax, ax
jne 0x1000ed09
imul eax, edi, 0x41c64e6d
imul ecx, edi, 0x10dcd
pop edi
pop ebx
pop esi
add eax, 0x3039
shr eax, 0x10
inc ecx
and ecx, 0xffff0000
or eax, ecx
ret

Function at 0x100107c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
pushal
call 0x100107cf
pop dword [ebp - 0x48]
mov eax, 0x32094ace
add eax, 0xddf7bd01
sub dword [ebp - 0x48], eax
mov dword [ebp - 0x58], 0x87e7cb87
sub dword [ebp - 0x58], 0x3995863c
mov dword [ebp - 0x54], 0x17a6c070
sub dword [ebp - 0x54], 0xe573742b
mov dword [ebp - 0x50], 0xb6dc0afc
sub dword [ebp - 0x50], 0x6a8fc6ce
mov dword [ebp - 0x4c], 0xd00e5f57
add dword [ebp - 0x4c], 0x2ff1a0a9
lea eax, [ebp - 0x58]
push eax
mov eax, 0x5af7a9b3
add eax, 0xb50a2755
add eax, dword [ebp - 0x48]
call dword [eax]
mov dword [ebp - 0x58], 0xd8e93781
add dword [ebp - 0x58], 0x9b8931d5
mov dword [ebp - 0x54], 0x81516f27
add dword [ebp - 0x54], 0xc01af24e
mov dword [ebp - 0x50], 0x7bc0c410
add dword [ebp - 0x50], 0xe7aea85c
mov dword [ebp - 0x4c], 0x9859c951
add dword [ebp - 0x4c], 0x67a636af
lea ebx, [ebp - 0x58]
push ebx
push eax
mov eax, 0x8dacdf37
sub eax, 0x7dab0ef3
add eax, dword [ebp - 0x48]
call dword [eax]
push 0x40
push 0x1000
push 0x3a824
push 0
call eax
mov ecx, 0x489e
mov esi, eax
mov edi, 0x10035000
add edi, dword [ebp - 0x48]
mov edx, 0xcb58a865
add edx, 0xb1c7fbed
mov dword [ebp - 0x20], 0xd5034b2d
mov ebx, dword [edi]
xor dword [ebp - 0x18], 0x84a936ba
add ebx, edx
sub dword [ebp - 0xc], eax
mov dword [esi], ebx
add dword [ebp - 0x18], 0xe2b283b4
add esi, 0x4887ba1b
sub esi, 0x4887ba17
add edi, 0xb4e5773c
add edi, 0x4b1a88c8
loop 0x100108e5
add eax, 0xa5bde6bf
sub eax, 0xa5bcd174
xor ebx, ebx
add ebx, eax
add eax, 0x3be53d3e
add eax, 0xc41ac2c7
mov ecx, 0x10000000
add ecx, dword [ebp - 0x48]
call ebx
leave
ret