joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4d8b20
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x4fdf18
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x543f30]
xor eax, esp
mov dword [esp + 0x20], eax
push ebx
push esi
push edi
mov eax, dword [0x543f30]
xor eax, esp
push eax
lea eax, [esp + 0x34]
mov dword fs:[0], eax
mov edi, dword [esp + 0x44]
mov esi, ecx
mov eax, dword [esi]
mov ecx, dword [eax + 0x140]
sub ecx, dword [eax + 0x13c]
cmp dword [esi + 0x78], ecx
jne 0x4d8bff
mov edx, dword [esi + 0x84]
sub edx, dword [esi + 0x80]
test edx, 0xfffffffc
je 0x4d8bff
mov ecx, dword [esi + 0x84]
cmp dword [ecx - 4], edi
jle 0x4d8bff
mov eax, dword [eax + 0x18]
test al, 3
jne 0x4d8b9b
test eax, 0x1000000
je 0x4d8bff
push str.Cant_terminate_a_sub_expression_with_an_alternation_operator_.
lea ecx, [esp + 0x18]
call fcn.00404f45
mov edi, dword [esi + 0x64]
sub edi, dword [esi + 0x5c]
xor eax, eax
sar edi, 1
push edi
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x30], esp
push 0xffffffffffffffff
mov dword [ecx + 0x10], eax
mov dword [ecx + 0x14], 0xf
push eax
mov dword [esp + 0x64], eax
mov byte [ecx], al
lea eax, [esp + 0x3c]
push eax
call fcn.004018a2
push edi
push 0x11
mov ecx, esi
call fcn.004d8170
cmp dword [esp + 0x28], 0x10
jb 0x4d8bf8
mov ecx, dword [esp + 0x14]
push ecx
call fcn.0049d71c
add esp, 4
xor al, al
jmp 0x4d8c80
mov edx, dword [esi + 0x84]
sub edx, dword [esi + 0x80]
test edx, 0xfffffffc
je 0x4d8c7e
mov eax, dword [esi + 0x84]
cmp dword [eax - 4], edi
jle 0x4d8c7e
mov edx, dword [eax - 4]
cmp dword [esi + 0x80], eax
je 0x4d8c32
add eax, 0xfffffffc
mov dword [esi + 0x84], eax
mov eax, dword [esi]
mov ecx, dword [eax + 0x13c]
mov ebx, dword [eax + 0x140]
sub ebx, ecx
add ebx, 3
and ebx, 0xfffffffc
add ebx, ecx
mov dword [eax + 0x140], ebx
mov eax, dword [esi]
mov ecx, dword [eax + 0x140]
sub ecx, dword [eax + 0x13c]
mov eax, dword [eax + 0x13c]
sub ecx, edx
mov dword [eax + edx + 8], ecx
mov ecx, dword [esi + 0x84]
sub ecx, dword [esi + 0x80]
test ecx, 0xfffffffc
jne 0x4d8c13
mov al, 1
mov ecx, dword [esp + 0x34]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.0049d196
add esp, 0x30
ret 4
Function at 0x4e7e50
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 4]
mov edx, dword [esp + 8]
xor ecx, ecx
cmp eax, edx
je 0x4e7e7f
push esi
push edi
mov esi, ecx
mov edi, ecx
shl esi, 6
shr edi, 2
add esi, edi
movsx edi, byte [eax]
lea esi, [esi + edi - 0x61c88647]
inc eax
xor ecx, esi
cmp eax, edx
jne 0x4e7e60
pop edi
pop esi
mov eax, 0x4e25
mul ecx
mov eax, ecx
sub eax, edx
shr eax, 1
add edx, eax
shr edx, 0x1e
imul edx, edx, 0x7fffd8ee
mov eax, ecx
sub eax, edx
add eax, 0x2710
ret

Function at 0x4e9a30
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x4fdf18
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x543f30]
xor eax, esp
mov dword [esp + 0x20], eax
push ebx
push esi
push edi
mov eax, dword [0x543f30]
xor eax, esp
push eax
lea eax, [esp + 0x34]
mov dword fs:[0], eax
mov edi, dword [esp + 0x44]
mov esi, ecx
mov eax, dword [esi]
mov ecx, dword [eax + 0x140]
sub ecx, dword [eax + 0x13c]
cmp dword [esi + 0x78], ecx
jne 0x4e9b0d
mov edx, dword [esi + 0x84]
sub edx, dword [esi + 0x80]
test edx, 0xfffffffc
je 0x4e9b0d
mov ecx, dword [esi + 0x84]
cmp dword [ecx - 4], edi
jle 0x4e9b0d
mov eax, dword [eax + 0x18]
test al, 3
jne 0x4e9aab
test eax, 0x1000000
je 0x4e9b0d
push str.Cant_terminate_a_sub_expression_with_an_alternation_operator_.
lea ecx, [esp + 0x18]
call fcn.00404f45
mov edi, dword [esi + 0x64]
sub edi, dword [esi + 0x5c]
xor eax, eax
push edi
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x30], esp
push 0xffffffffffffffff
mov dword [ecx + 0x10], eax
mov dword [ecx + 0x14], 0xf
push eax
mov dword [esp + 0x64], eax
mov byte [ecx], al
lea eax, [esp + 0x3c]
push eax
call fcn.004018a2
push edi
push 0x11
mov ecx, esi
call fcn.004e90b0
cmp dword [esp + 0x28], 0x10
jb 0x4e9b06
mov ecx, dword [esp + 0x14]
push ecx
call fcn.0049d71c
add esp, 4
xor al, al
jmp 0x4e9b8e
mov edx, dword [esi + 0x84]
sub edx, dword [esi + 0x80]
test edx, 0xfffffffc
je 0x4e9b8c
mov eax, dword [esi + 0x84]
cmp dword [eax - 4], edi
jle 0x4e9b8c
mov edx, dword [eax - 4]
cmp dword [esi + 0x80], eax
je 0x4e9b40
add eax, 0xfffffffc
mov dword [esi + 0x84], eax
mov eax, dword [esi]
mov ecx, dword [eax + 0x13c]
mov ebx, dword [eax + 0x140]
sub ebx, ecx
add ebx, 3
and ebx, 0xfffffffc
add ebx, ecx
mov dword [eax + 0x140], ebx
mov eax, dword [esi]
mov ecx, dword [eax + 0x140]
sub ecx, dword [eax + 0x13c]
mov eax, dword [eax + 0x13c]
sub ecx, edx
mov dword [eax + edx + 8], ecx
mov ecx, dword [esi + 0x84]
sub ecx, dword [esi + 0x80]
test ecx, 0xfffffffc
jne 0x4e9b21
mov al, 1
mov ecx, dword [esp + 0x34]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.0049d196
add esp, 0x30
ret 4
Function at 0x4f5ed0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0xf0
mov eax, 0x517812
mov dword [esp], eax
mov dword [esp + 4], 0x517034
mov dword [esp + 8], 0x518c78
mov dword [esp + 0xc], 0x517030
mov dword [esp + 0x10], 0x514118
mov dword [esp + 0x14], 0x517dd8
mov dword [esp + 0x18], 0x5175f4
mov dword [esp + 0x1c], 0x514138
mov dword [esp + 0x20], 0x51702c
mov dword [esp + 0x24], 0x51a0c4
mov dword [esp + 0x28], 0x509908
mov dword [esp + 0x2c], 0x514114
mov dword [esp + 0x30], 0x50f4a4
mov dword [esp + 0x34], 0x517028
mov dword [esp + 0x38], 0x50a13c
mov dword [esp + 0x3c], 0x517024
mov dword [esp + 0x40], 0x517020
mov dword [esp + 0x44], str.0123456789
mov dword [esp + 0x48], 0x516d2c
mov dword [esp + 0x4c], 0x516de8
mov dword [esp + 0x50], 0x519f48
mov dword [esp + 0x54], 0x519f04
mov dword [esp + 0x58], eax
mov dword [esp + 0x5c], eax
mov dword [esp + 0x60], 0x517010
mov dword [esp + 0x64], 0x51700c
mov dword [esp + 0x68], 0x517fb4
mov dword [esp + 0x6c], 0x50c92c
mov dword [esp + 0x70], 0x50ebe4
mov dword [esp + 0x74], 0x516d24
mov dword [esp + 0x78], 0x516d04
mov dword [esp + 0x7c], 0x50a138
mov dword [esp + 0x80], 0x516cf0
mov dword [esp + 0x84], 0x516ce8
mov dword [esp + 0x88], 0x516ce4
mov dword [esp + 0x8c], 0x516d28
mov dword [esp + 0x90], 0x510544
mov dword [esp + 0x94], 0x510474
mov dword [esp + 0x98], 0x517d88
mov dword [esp + 0x9c], eax
mov dword [esp + 0xa0], eax
mov dword [esp + 0xa4], eax
mov dword [esp + 0xa8], eax
mov dword [esp + 0xac], eax
mov dword [esp + 0xb0], eax
mov dword [esp + 0xb4], eax
mov dword [esp + 0xb8], eax
mov dword [esp + 0xbc], 0x517d84
mov dword [esp + 0xc0], 0x516db4
mov dword [esp + 0xc4], 0x516d98
mov dword [esp + 0xc8], 0x5175f8
mov dword [esp + 0xcc], str.ZYXWVUTSRQPONMLKJIHGFDBA
mov dword [esp + 0xd0], 0x516ddc
mov dword [esp + 0xd4], 0x50cb10
mov dword [esp + 0xd8], 0x516cfc
mov dword [esp + 0xdc], 0x516db8
mov dword [esp + 0xe0], 0x516dc0
mov dword [esp + 0xe4], 0x517008
mov dword [esp + 0xe8], 0x516dcc
mov dword [esp + 0xec], 0x516db0
cmp cl, 0x3c
jae 0x4f60ed
movzx eax, cl
mov eax, dword [esp + eax*4]
add esp, 0xf0
ret
Function at 0x4f6120
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x9c
mov eax, dword [0x543f30]
xor eax, esp
mov dword [esp + 0x98], eax
mov edx, 0x361
mov dword [esp], 0x3610300
mov dword [esp + 4], 0x4860483
mov dword [esp + 8], 0x9030903
mov dword [esp + 0xc], 0x940093e
mov dword [esp + 0x10], 0x94c0949
mov dword [esp + 0x14], 0x9830982
mov dword [esp + 0x18], 0x9c009be
mov dword [esp + 0x1c], 0x9cc09c7
mov dword [esp + 0x20], 0x9d709d7
mov dword [esp + 0x24], 0xa400a3e
mov dword [esp + 0x28], 0xa830a83
mov dword [esp + 0x2c], 0xac00abe
mov dword [esp + 0x30], 0xacc0ac9
mov dword [esp + 0x34], 0xb030b02
mov dword [esp + 0x38], 0xb3e0b3e
mov dword [esp + 0x3c], 0xb400b40
mov dword [esp + 0x40], 0xb4c0b47
mov dword [esp + 0x44], 0xb570b57
mov dword [esp + 0x48], 0xb830b83
mov dword [esp + 0x4c], 0xbbf0bbe
mov dword [esp + 0x50], 0xbcc0bc1
mov dword [esp + 0x54], 0xbd70bd7
mov dword [esp + 0x58], 0xc030c01
mov dword [esp + 0x5c], 0xc440c41
mov dword [esp + 0x60], 0xc830c82
mov dword [esp + 0x64], 0xcbe0cbe
mov dword [esp + 0x68], 0xcc40cc0
mov dword [esp + 0x6c], 0xccb0cc7
mov dword [esp + 0x70], 0xcd60cd5
mov dword [esp + 0x74], 0xd030d02
mov dword [esp + 0x78], 0xd400d3e
mov dword [esp + 0x7c], 0xd4c0d46
mov dword [esp + 0x80], 0xd570d57
mov dword [esp + 0x84], 0xf7f0f7f
mov dword [esp + 0x88], 0x20e120d0
mov dword [esp + 0x8c], 0x309a3099
mov dword [esp + 0x90], 0xfe23fe20
mov dword [esp + 0x94], 0xffffffff
lea eax, [esp + 2]
cmp dx, cx
jae 0x4f628b
add eax, 4
cmp word [eax], cx
jb 0x4f6283
sub eax, 2
cmp cx, word [eax]
jb 0x4f62b0
cmp cx, word [eax + 2]
ja 0x4f62b0
mov al, 1
mov ecx, dword [esp + 0x98]
xor ecx, esp
call fcn.0049d196
add esp, 0x9c
ret
mov ecx, dword [esp + 0x98]
xor ecx, esp
xor al, al
call fcn.0049d196
add esp, 0x9c
ret

Function at 0x431002
Capabilities:
Encode data using xor

Disassembly:
pushal
nop
nop
nop
nop
mov eax, section..text
mov ebx, 0x40915c
nop
mov ecx, 0x2952228a
nop
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x43104e
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x431024
nop
nop
mov eax, section..data
mov ebx, 0x42f3f8
nop
mov ecx, 0x50a95ed5
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
je 0x431084
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x43106c
nop
nop
popal
nop
nop
nop
nop
jmp 0x401219
Function at 0x431005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
call 0x43100c
nop
nop
pop eax
nop
nop
nop
add eax, 0x403e6a
nop
sub eax, 0x403e10
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
cmp ebx, ecx
jl 0x431030
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
nop
nop
cmp dword [eax], 0
nop
jne 0x43101e
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp fcn.00401219

Function at 0x40b580
Capabilities:
Encode data using xor

Disassembly:
xchg byte [eax - 0x7f8929d1], ah
xor ebp, dword [ebp + 0x16ffd03b]
pop ds
dec ebp
push edi
imul esi, dword [ecx + edx*8 - 0x47], 0xffffffd2
jp 0x40b56c
Function at 0x408164
Capabilities:
Encode data using xor

Disassembly:
cmpsb byte [esi], byte es:[edi]
adc cl, dh
sbb eax, 0x31c23158
sal dword [ecx], 1
stc
mov edx, 0x705c204d
mov esi, 0x28832
xor edx, esi
mov esi, 0x2fb84d53
xor edx, esi
mov esi, edx
add esp, 0xfffffffc
mov dword [esp], esi
mov esi, 0x7fa80c77
mov ebx, 0x60888c77
xor ebx, esi
mov edx, 0x40040404
mov eax, 0x820000
xor edx, eax
xor ebx, edx
pop edi
xor ebx, edi
mov eax, 0x2dd3f44a
mov edx, 0x2dd3fd4e
xor edx, eax
mov eax, 0x5a2c6f
mov esi, 0x5a2c4f
xor esi, eax
xor edx, esi
mov esi, 0x47577cb9
xor esi, 0x1f2ee487
push esi
mov edi, 0x646e802c
xor edi, 0x3c574892
pop eax
xor edi, eax
xor edx, edi
mov esi, 0x22a18f48
mov eax, 0xdd5e70b4
xor esi, eax
add esp, esi
mov esi, esp
out 0x56, al
pop edi
mov dword [edi], ecx
xor esi, esi
add esi, edx
mov edi, 0
xor edi, esi
add esp, 0xfffffffc
mov dword [esp], edi
xor ecx, ecx
mov cl, byte [ebx]
add edx, ecx
mov cl, byte [edx]
pop edx
mov byte [ebx], cl
mov esi, 0xf22db05
mov edi, 0xf0dd24fa
xor esi, edi
add ebx, esi
pop ecx
mov edi, 0x70909c51
mov esi, 0x70909c50
xor esi, edi
sub ecx, esi
mov eax, 4
sub esp, eax
les ecx, [ecx + 0x5e0f89e7]
or esi, 0
jne 0x4081dd
push 0x78df5ef3
mov ecx, 0x5b9aaf9d
pop ebx
xor ecx, ebx
push ecx
push 0x10067e7a
mov edx, 0x3ea0be35
pop edi
xor edx, edi
pop eax
xor edx, eax
push 0x4809b7a5
mov esi, 0x50830699
pop ebx
xor esi, ebx
mov edi, 0x1529de21
xor esi, edi

Function at 0x408fbc
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
mov esi, edx
mov ebx, eax
lea edx, [ebp - 0xc]
mov eax, ebx
call fcn.00408f70
test al, al
jne 0x408fdd
xor eax, eax
mov dword [ebp - 4], eax
jmp 0x409029
xor eax, eax
push ebp
push 0x409019
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.00403414
push eax
call sub.kernel32.dll_DeleteFileA
mov dword [ebp - 4], eax
call sub.kernel32.dll_GetLastError_1
mov dword [ebp - 0x10], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x409020
lea eax, [ebp - 0xc]
call fcn.00408fac
ret
mov eax, dword [ebp - 4]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x409330
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov esi, eax
xor eax, eax
push ebp
push 0x40941f
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
call fcn.00406cf4
mov edx, dword [ebp - 8]
mov ecx, 0x409438
xor eax, eax
call fcn.00409224
push 0
mov eax, dword [ebp - 4]
call fcn.00403414
push eax
call sub.kernel32.dll_CreateDirectoryA
test eax, eax
jne 0x4093ed
call sub.kernel32.dll_GetLastError_1
mov ebx, eax
cmp ebx, 0xb7
je 0x409350
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 0x18]
mov edx, dword [ebp - 4]
mov al, 0x35
call fcn.00408dd8
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x14], eax
lea edx, [ebp - 0x1c]
mov eax, ebx
call fcn.00404c84
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x10], eax
lea edx, [ebp - 0x20]
mov eax, ebx
call fcn.00407284
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0xc], eax
lea edx, [ebp - 0x14]
mov ecx, 2
mov al, 0x67
call fcn.00408da8
mov ecx, dword [ebp - 8]
mov dl, 1
mov eax, 0x404650
call fcn.00405880
call fcn.00402eb4
jmp 0x409350
mov eax, esi
mov edx, dword [ebp - 4]
call fcn.0040322c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x409426
lea eax, [ebp - 0x20]
mov edx, 3
call fcn.004031b8
lea eax, [ebp - 8]
mov edx, 2
call fcn.004031b8
ret

Function at 0x409448
Capabilities:
Shutdown system

Disassembly:
add esp, 0xffffffec
cmp dword [0x40b07c], 2
jne 0x4094af
push esp
push 0x28
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.advapi32.dll_OpenProcessToken
test eax, eax
jne 0x40946a
xor eax, eax
jmp 0x4094be
lea eax, [esp + 8]
push eax
push 0x4094c4
push 0
call sub.advapi32.dll_LookupPrivilegeValueA
mov dword [esp + 4], 1
mov dword [esp + 0x10], 2
push 0
push 0
push 0
lea eax, [esp + 0x10]
push eax
push 0
mov eax, dword [esp + 0x14]
push eax
call sub.advapi32.dll_AdjustTokenPrivileges
call sub.kernel32.dll_GetLastError_1
test eax, eax
je 0x4094af
xor eax, eax
jmp 0x4094be
push 0
push 2
call sub.user32.dll_ExitWindowsEx
neg eax
sbb eax, eax
neg eax
add esp, 0x14
ret

Function at 0x4094d8
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov ebx, eax
mov esi, ecx
dec esi
test esi, esi
jl 0x409532
inc esi
xor edi, edi
cmp edi, 1
jne 0x4094fe
mov eax, dword [ebp + 0xc]
push eax
call sub.kernel32.dll_Sleep
jmp 0x40950c
cmp edi, 1
jle 0x40950c
mov eax, dword [ebp + 8]
push eax
call sub.kernel32.dll_Sleep
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.00408fbc
test eax, eax
jne 0x409532
call sub.kernel32.dll_GetLastError_1
cmp eax, 2
je 0x409532
call sub.kernel32.dll_GetLastError_1
cmp eax, 3
je 0x409532
inc edi
dec esi
jne 0x4094ee
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 8
Function at 0x409b30
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffbc
mov edi, eax
lea esi, [esp + 0x28]
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetSystemInfo
mov ebx, edi
push 0x1c
push esi
push ebx
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x409be4
jmp 0x409bd9
cmp dword [esi + 0x10], 0x1000
jne 0x409bc5
test byte [esi + 0x15], 1
jne 0x409bc5
xor ebx, ebx
mov eax, dword [esi + 0x14]
cmp eax, 1
je 0x409b84
cmp eax, 2
je 0x409b84
cmp eax, 0x10
je 0x409b84
cmp eax, 0x20
jne 0x409b99
push esp
push 0x40
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x409b99
mov bl, 1
xor ebp, ebp
jmp 0x409baa
mov eax, dword [esi]
add eax, ebp
call fcn.00409b28
add ebp, dword [esp + 8]
cmp ebp, dword [esi + 0xc]
jb 0x409b9d
test bl, bl
je 0x409bc5
push esp
mov eax, dword [esp + 4]
push eax
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
mov eax, dword [esi]
add eax, dword [esi + 0xc]
mov ebx, eax
push 0x1c
push esi
push ebx
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x409be4
mov eax, dword [esi + 4]
cmp eax, edi
je 0x409b5c
add esp, 0x44
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x800a8e0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x7000]
push edi
or ebp, 0xffffffff
jmp 0x800a902
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x800a909
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x800a8f8
mov eax, 1
add ebx, ebx
jne 0x800a91b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x800a910
jne 0x800a92c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x800a910
xor ecx, ecx
sub eax, 3
jb 0x800a940
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x800a9b2
mov ebp, eax
add ebx, ebx
jne 0x800a94b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x800a958
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x800a97c
inc ecx
add ebx, ebx
jne 0x800a968
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x800a95d
jne 0x800a979
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x800a95d
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x800a99c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x800a98d
jmp 0x800a8fe
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x800a99c
add edi, ecx
jmp 0x800a8fe
pop esi
mov edi, esi
mov ecx, 0x1a
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x800a9ba
cmp byte [edi], 1
jne 0x800a9ba
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x800a9bf
lea edi, [esi + 0x8000]
mov eax, dword [edi]
or eax, eax
je 0x800aa2e
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xc10c]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xc164]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x800a9ec
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xc16c]
or eax, eax
je 0x800aa28
mov dword [ebx], eax
add ebx, 4
jmp 0x800aa09
call dword [esi + 0xc168]
mov ebp, dword [esi + 0xc170]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x217]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x800aa62
sub esp, 0xffffff80
jmp section.UPX0
Function at 0x4323e1
Capabilities:
Create pipe
Get thread local storage value
Query environment variable

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x200c
call fcn.00442e00
mov eax, dword [0x47e86c]
mov ecx, dword [0x47e2f8]
push ebx
push esi
shr eax, 3
xor esi, esi
push edi
cmp eax, esi
jbe 0x4324d7
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov ebx, ecx
mov dword [ebp - 4], eax
cmp dword [0x47e86c], 0x959
jne 0x4324c5
push esi
lea eax, [ebp - 0xc08]
push eax
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetNumberFormatW]
push 0x430d60
push esi
call dword [sym.imp.KERNEL32.dll_CreateJobObjectW]
push esi
lea eax, [ebp - 0x1808]
push eax
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasExesA]
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_EnumDateFormatsW]
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_SetFileShortNameW]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_SetProcessShutdownParameters]
push esi
push esi
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetTimeFormatA]
push esi
push esi
push esi
call edi
push esi
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
lea eax, [ebp - 0x1408]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetVolumeMountPointW]
push esi
lea eax, [ebp - 0x408]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
push 0x430d88
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_SetCalendarInfoA]
push esi
lea eax, [ebp - 0x2008]
push eax
push esi
call edi
push ebx
call fcn.00432193
add ebx, 8
dec dword [ebp - 4]
jne 0x432414
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4338b1
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
mov eax, 0x4473bc
call fcn.00447240
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
lea ecx, [esi + 4]
mov dword [esi], 0x43112c
call fcn.00434591
xor edi, edi
push 4
mov dword [ebp - 4], edi
call fcn.00435958
mov ebx, eax
pop ecx
cmp ebx, edi
je 0x4338f9
call fcn.00434345
mov dword [ebx], eax
call fcn.00434104
mov ecx, eax
call fcn.00431dd1
mov eax, ebx
jmp 0x4338fb
xor eax, eax
mov dword [esi + 0x38], eax
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
lea ecx, [esi + 0x1c]
mov dword [esi + 0x24], ecx
lea eax, [esi + 8]
mov dword [esi + 0x10], eax
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x2c]
mov dword [esi + 0x34], ecx
mov dword [eax], edi
mov eax, dword [esi + 0x24]
mov dword [eax], edi
mov eax, dword [esi + 0x34]
mov dword [eax], edi
mov eax, dword [esi + 0x10]
mov dword [eax], edi
mov eax, dword [esi + 0x20]
mov dword [eax], edi
mov eax, dword [esi + 0x30]
mov dword [eax], edi
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x3c], edi
mov dword [esi + 0x40], edi
pop edi
mov dword [esi], 0x431184
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 4

Function at 0x435fe0
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x449600]
jne 0x435fea
repz ret
jmp fcn.0043b81c