joyce8/EMBER2024-capa huggingface dataset:
Function at 0x80f8b0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, 0x5ce00d
lea edi, [esi - 0x1cd00d]
push edi
or ebp, 0xffffffff
jmp 0x80f8d2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x80f8d9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x80f8c8
mov eax, 1
add ebx, ebx
jne 0x80f8eb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x80f8e0
jne 0x80f8fc
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x80f8e0
xor ecx, ecx
sub eax, 3
jb 0x80f910
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x80f982
mov ebp, eax
add ebx, ebx
jne 0x80f91b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x80f928
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x80f94c
inc ecx
add ebx, ebx
jne 0x80f938
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x80f92d
jne 0x80f949
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x80f92d
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x80f96c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x80f95d
jmp 0x80f8ce
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x80f96c
add edi, ecx
jmp 0x80f8ce
pop esi
mov edi, esi
mov ecx, 0x149d
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x80f98a
cmp byte [edi], 0x11
jne 0x80f98a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x80f98f
lea edi, [esi + 0x40b000]
mov eax, dword [edi]
or eax, eax
je 0x80f9fe
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x41715c]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x4171b4]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x80f9bc
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x4171bc]
or eax, eax
je 0x80f9f8
mov dword [ebx], eax
add ebx, 4
jmp 0x80f9d9
call dword [esi + 0x4171b8]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x80fa2f
cmp al, 0xef
ja 0x80fa22
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x80fa04
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x80fa11
mov ebp, dword [esi + 0x4171c0]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x197]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x80fa63
sub esp, 0xffffff80
jmp 0x41a69f
Function at 0x402e89
Capabilities:
Enumerate pe sections

Disassembly:
or dword [eax - 0x49f0f6be], ecx
inc ecx
or byte [eax + 0x4eb0842], cl
mov edx, dword [esp + 0x10]
movzx eax, byte [ecx + 7]
mov byte [edx + 7], al
inc edx
pop es
movzx eax, byte [ecx + 6]
mov byte [edx + 6], al
movzx eax, byte [ecx + 5]
mov byte [edx + 5], al
movzx eax, byte [ecx + 4]
mov byte [edx + 4], al
movzx eax, byte [ecx + 3]
mov byte [edx + 3], al
inc edx
add ecx, dword [edi]
mov dh, 0x41
add cl, byte [eax + 0x418a0242]
invalid
mov byte [edx + 1], al

Function at 0x403eb5
Capabilities:
Contain obfuscated stackstrings

Disassembly:
jne 0x403f6f
mov ecx, dword [esi + 0x40]
lea eax, [esp + 0x14]
push eax
movzx eax, word [ecx + 0x16]
movzx ecx, word [ecx + 0x14]
shl eax, 4
add eax, ecx
mov ecx, esi
cdq
push edx
push eax
mov eax, dword [esi + 0x20]
mov edx, 0x1b
call eax
mov al, byte [esp + 0x64]
test al, al
je 0x403ea6
dec al
jmp 0x403eac
mov eax, dword [esi + 0x40]
mov al, byte [eax + 0x1a]
mov byte [esp + 0x14], al
mov al, byte [esp + 0x6d]
or al, 0x20
and bh, al
inc esp
and al, 0x15
dec eax
push ebp
inc edi
dec edi
mov dword [esp + 0x19], 0x20202020
cmp al, 0x65
jne 0x403ed8
mov word [esp + 0x1d], 0x5845
mov byte [esp + 0x1f], 0x45
jmp 0x403ee4
mov word [esp + 0x1d], 0x4f43
mov byte [esp + 0x1f], 0x4d
mov ecx, dword [esi + 0x40]
lea eax, [esp + 0x14]
push eax
mov byte [esp + 0x24], 0x20
mov dword [esp + 0x2f], 0x123c110e
mov dword [esp + 0x33], 0x75300100
mov word [esp + 0x37], 0
movzx eax, word [ecx + 0x16]
movzx ecx, word [ecx + 0x14]
shl eax, 4
add eax, ecx
mov ecx, esi
cdq
push edx
push eax
mov eax, dword [esi + 0x24]
mov edx, 0x1b
call eax
mov byte [esi + 0x110], 0
mov byte [esi + 0x110], 0xff
jmp 0x403f2b

Function at 0x404441
Capabilities:
Contain obfuscated stackstrings

Disassembly:
or byte [esi + 0x198], 1
jmp 0x403f2b
cmp al, 0x2a
je 0x404449
cmp al, 0x3f
jne 0x4043ee
mov ecx, dword [esi + 0x40]
lea eax, [esp + 0x38]
push eax
movzx eax, word [ecx + 0x16]
movzx ecx, word [ecx + 0x14]
shl eax, 4
add eax, ecx
mov ecx, esi
cdq
push edx
push eax
mov eax, dword [esi + 0x20]
mov edx, 0x2b
call eax
mov ecx, dword [esi + 0x40]
lea eax, [esp + 0x38]
push eax
mov dword [esp + 0x5a], 0x4f475548
mov dword [esp + 0x5e], 0x4d4f432e
mov byte [esp + 0x62], 0
mov byte [esp + 0x51], 0x20
mov dword [esp + 0x52], 0x123c110e
mov dword [esp + 0x56], 0x7530
movzx eax, word [ecx + 0x16]
movzx ecx, word [ecx + 0x14]
shl eax, 4
add eax, ecx
mov ecx, esi
cdq
push edx
push eax
mov eax, dword [esi + 0x24]
mov edx, 0x2b
call eax
and byte [esi + 0x198], 0xfe
jmp 0x403f2b
Function at 0x1000cd31
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0x424
mov eax, 0x1002cd97
call fcn.10017073
mov eax, dword [ebp + 0xc]
xor esi, esi
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x420], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x41c], eax
mov dword [ebp - 0x430], esi
mov dword [ebp - 4], esi
mov dword [ebp - 0x428], ecx
mov dword [ebp - 0x42c], esi
mov dword [ebp - 0x418], esi
push 0x60
push esi
push ebx
mov byte [ebp - 4], 1
call dword [sym.imp.kernel32.dll_LoadLibraryExW]
mov edi, eax
mov dword [ebp - 0x424], edi
test edi, edi
jne 0x1000cdae
push 2
push esi
push ebx
call dword [sym.imp.kernel32.dll_LoadLibraryExW]
mov edi, eax
mov dword [ebp - 0x424], eax
test edi, edi
jne 0x1000cdae
call fcn.10005a99
mov esi, eax
jmp 0x1000ce85
push dword [ebp - 0x41c]
push dword [ebp - 0x420]
push edi
call dword [sym.imp.kernel32.dll_FindResourceW]
mov ebx, eax
test ebx, ebx
jne 0x1000cdd1
call fcn.10005a99
jmp 0x1000ce78
push ebx
push edi
call dword [sym.imp.kernel32.dll_LoadResource]
mov dword [ebp - 0x41c], eax
test eax, eax
je 0x1000cdc7
push ebx
push edi
call dword [sym.imp.kernel32.dll_SizeofResource]
mov ebx, eax
mov dword [ebp - 0x420], ebx
lea eax, [ebx + 1]
cmp eax, ebx
jae 0x1000ce01
mov esi, 0x8007000e
jmp 0x1000ce7a
push eax
lea ecx, [ebp - 0x418]
mov byte [ebp - 4], 2
call fcn.10020ab3
jmp 0x1000ce27
cmp dword [ebp - 0x418], 0
mov dword [ebp - 4], 1
je 0x1000cdfa
push ebx
push dword [ebp - 0x418]
push ebx
push dword [ebp - 0x41c]
push esi
push 3
call dword [sym.imp.kernel32.dll_MultiByteToWideChar]
mov ecx, eax
test ecx, ecx
je 0x1000cdc7
mov eax, dword [ebp - 0x418]
xor edx, edx
push dword [ebp + 0x14]
mov word [eax + ecx*2], dx
lea ecx, [ebp - 0x42c]
push dword [ebp - 0x418]
call fcn.10020ab3
mov esi, eax
test edi, edi
je 0x1000ce85
push edi
call dword [sym.imp.kernel32.dll_FreeLibrary]
lea eax, [ebp - 0x414]
cmp dword [ebp - 0x418], eax
je 0x1000ce9e
lea ecx, [ebp - 0x418]
call fcn.1000c4af
mov eax, esi
call fcn.10016fc0
ret 0x10
Function at 0x100123e7
Capabilities:
Delete file

Disassembly:
push 0x14
mov eax, 0x1002d2cf
call fcn.10016fd1
mov ebx, ecx
mov eax, dword [ebx]
xor edi, edi
mov esi, dword [eax + 0x18]
mov ecx, esi
call dword [0x1002f4d0]
mov ecx, ebx
call esi
push eax
lea ecx, [ebp - 0x10]
call fcn.10020ab3
and dword [ebp - 4], edi
lea esi, [ebx + 0x44]
cmp dword [esi], edi
je 0x10012492
push str.Excel.Application
lea ecx, [ebp - 0x10]
call fcn.10020ab3
mov ecx, dword [esi]
test al, al
je 0x10012474
push 0xb
pop eax
mov word [ebp - 0x20], ax
xor eax, eax
mov word [ebp - 0x18], ax
sub esp, 0x10
mov byte [ebp - 4], 1
mov edi, esp
lea esi, [ebp - 0x20]
push 1
movsd dword es:[edi], dword [esi]
push str.Close
push ecx
push eax
movsd dword es:[edi], dword [esi]
push 1
push ebx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call fcn.10020ab3
add esp, 0x28
mov byte [ebp - 4], 0
mov edi, eax
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.oleaut32.dll_VariantCopy]
lea esi, [ebx + 0x44]
jmp 0x1001248b
push 0
push str.Close
push ecx
push 0
push 1
push ebx
call fcn.10020ab3
add esp, 0x18
mov edi, eax
mov ecx, esi
call fcn.10009bb3
cmp dword [ebx + 0x24], 0
je 0x100124b2
push str.Excel.Application
lea ecx, [ebp - 0x10]
call fcn.10020ab3
test al, al
je 0x100124b2
push dword [ebx + 0x24]
call dword [sym.imp.kernel32.dll_DeleteFileW]
push dword [ebp - 0x10]
call dword [sym.imp.oleaut32.dll_SysStringLen]
mov eax, edi
call fcn.10016f9a
ret
Function at 0x100133d0
Capabilities:
Copy file
Set file attributes

Disassembly:
push 0x214
mov eax, 0x1002d3b0
call fcn.10017005
mov ebx, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x21c], eax
cmp dword [ebx + 8], 0
je 0x100133fb
mov eax, reloc.oleaut32.dll_VariantCopyInd
jmp 0x10013586
mov eax, dword [ebx - 0xc]
mov esi, dword [eax + 0x10]
mov ecx, esi
call dword [0x1002f4d0]
lea ecx, [ebx - 0xc]
call esi
mov ecx, dword [ebx + 0x14]
test ecx, ecx
jne 0x1001341f
mov eax, 0x80004005
jmp 0x10013586
mov edx, dword [ebp + 0x10]
mov esi, reloc.oleaut32.dll_SysReAllocString
mov eax, edx
and eax, esi
cmp eax, esi
push dword [ebp - 0x21c]
sete al
mov byte [ecx + 0x31], al
lea ecx, [esi + 2]
mov eax, edx
and eax, ecx
cmp eax, ecx
mov eax, dword [ebx + 0x14]
sete cl
mov byte [eax + 0x32], cl
lea eax, [esi + 6]
and edx, eax
cmp edx, eax
mov eax, dword [ebx + 0x14]
sete cl
mov byte [eax + 0x33], cl
mov ecx, dword [ebx + 0x14]
add ecx, 0x28
call fcn.10020ab3
mov edi, dword [ebx + 0x14]
mov eax, dword [edi]
mov esi, dword [eax + 0x18]
mov ecx, esi
call dword [0x1002f4d0]
mov ecx, edi
call esi
push eax
lea ecx, [ebp - 0x220]
call fcn.10020ab3
xor esi, esi
lea ecx, [ebp - 0x220]
push str.Excel.Application
mov dword [ebp - 4], esi
call fcn.10020ab3
test al, al
je 0x1001355e
push 0x208
lea eax, [ebp - 0x218]
push esi
push eax
call fcn.100194b0
mov edi, dword [ebp - 0x21c]
push 0x5c
push edi
call fcn.10020ab3
add esp, 0x14
test eax, eax
jne 0x100134d8
push 0x2f
push edi
call fcn.10020ab3
pop ecx
pop ecx
test eax, eax
je 0x100134f8
add eax, 2
push 0x2e
push eax
call fcn.10020ab3
push eax
lea eax, [ebp - 0x218]
push 0x104
push eax
call fcn.10020ab3
add esp, 0x14
cmp word [ebp - 0x218], si
je 0x10013557
push esi
lea eax, [ebp - 0x218]
push eax
push edi
call dword [sym.imp.kernel32.dll_CopyFileW]
lea eax, [ebp - 0x218]
push esi
push eax
call fcn.10020ab3
pop ecx
pop ecx
mov ecx, dword [ebx + 0x14]
add ecx, 0x24
test eax, eax
jne 0x10013549
lea eax, [ebp - 0x218]
push eax
call fcn.10020ab3
push 0x80
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.kernel32.dll_SetFileAttributesW]
jmp 0x1001354f
push edi
call fcn.10020ab3
mov eax, dword [ebx + 0x14]
add eax, 0x24
jmp 0x1001356f
mov esi, 0x80004005
jmp 0x10013578
mov ecx, dword [ebx + 0x14]
push dword [ebp - 0x21c]
add ecx, 0x24
call fcn.10020ab3
push eax
lea ecx, [ebx + 0x10]
call fcn.10020ab3
push dword [ebp - 0x220]
call dword [sym.imp.oleaut32.dll_SysStringLen]
mov eax, esi
call fcn.10016faf
ret 0xc
Function at 0x10013c40
Capabilities:
Terminate process

Disassembly:
push 0x81c
mov eax, 0x1002d483
call fcn.10017005
mov ebx, ecx
xor ecx, ecx
lea edi, [ebx + 0x40]
mov esi, ecx
mov dword [ebp - 0x818], ecx
mov dword [ebp - 0x814], ecx
cmp dword [edi], ecx
je 0x10013d7c
push 0x10
push ecx
lea eax, [ebp - 0x828]
push eax
call fcn.100194b0
add esp, 0xc
lea eax, [ebp - 0x828]
push eax
call dword [sym.imp.oleaut32.dll_VariantClear]
push esi
push str.Caption
push dword [edi]
lea eax, [ebp - 0x828]
mov dword [ebp - 4], esi
push eax
push 2
push ebx
call fcn.10020ab3
add esp, 0x18
test eax, eax
jne 0x10013ce1
push dword [ebp - 0x820]
mov word [ebp - 0x810], ax
lea eax, [ebp - 0x810]
push 0x400
push eax
call fcn.10020ab3
add esp, 0xc
lea eax, [ebp - 0x810]
push eax
push esi
call dword [sym.imp.user32.dll_FindWindowW]
mov dword [ebp - 0x814], eax
mov eax, dword [ebx]
lea ecx, [ebp - 0x818]
push ecx
mov esi, dword [eax + 0x2c]
mov ecx, esi
call dword [0x1002f4d0]
mov ecx, ebx
call esi
mov esi, eax
test esi, esi
js 0x10013d20
cmp dword [ebp - 0x818], 0
jne 0x10013d20
push 0
push str.Quit
push dword [edi]
push 0
push 1
push ebx
call fcn.10020ab3
add esp, 0x18
mov esi, eax
mov ecx, edi
call fcn.10009bb3
lea eax, [ebp - 0x828]
push eax
call dword [sym.imp.oleaut32.dll_VariantCopy]
mov eax, dword [ebp - 0x814]
test eax, eax
je 0x10013d7c
cmp dword [ebp - 0x818], 0
jne 0x10013d7c
test esi, esi
jns 0x10013d7c
and dword [ebp - 0x814], 0
lea ecx, [ebp - 0x814]
push ecx
push eax
call dword [sym.imp.user32.dll_GetWindowThreadProcessId]
push dword [ebp - 0x814]
push 1
push 0x1fffff
call dword [sym.imp.kernel32.dll_OpenProcess]
push 1
push eax
call dword [sym.imp.kernel32.dll_TerminateProcess]
mov eax, esi
call fcn.10016faf
ret
Function at 0x10015217
Capabilities:
Enumerate processes

Disassembly:
push 0x238
mov eax, 0x1002d711
call fcn.10017005
mov ebx, dword [ebp + 8]
test ebx, ebx
jne 0x10015234
xor eax, eax
jmp 0x10015311
xor edi, edi
push edi
push 2
call sub.kernel32.dll_CreateToolhelp32Snapshot
mov esi, eax
test esi, esi
je 0x1001530f
lea eax, [ebp - 0x23c]
mov dword [ebp - 0x23c], 0x22c
push eax
push esi
call sub.kernel32.dll_Process32FirstW
jmp 0x100152e5
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x244]
call fcn.1000128b
push ebx
lea ecx, [ebp - 0x240]
mov dword [ebp - 4], edi
call fcn.1000128b
lea ecx, [ebp - 0x244]
mov byte [ebp - 4], 1
call fcn.10001cc6
lea ecx, [ebp - 0x240]
call fcn.10001cc6
lea eax, [ebp - 0x244]
push eax
lea eax, [ebp - 0x240]
push eax
call fcn.10020ab3
pop ecx
pop ecx
mov ecx, dword [ebp - 0x240]
lea ecx, [ecx - 0x10]
test al, al
jne 0x100152ef
call fcn.10001eb4
mov ecx, dword [ebp - 0x244]
or dword [ebp - 4], 0xffffffff
lea ecx, [ecx - 0x10]
call fcn.10001eb4
lea eax, [ebp - 0x23c]
push eax
push esi
call sub.kernel32.dll_Process32NextW
test eax, eax
jne 0x10015264
jmp 0x10015308
mov edi, dword [ebp - 0x234]
call fcn.10001eb4
mov ecx, dword [ebp - 0x244]
add ecx, 0xfffffff0
call fcn.10001eb4
push esi
call dword [sym.imp.kernel32.dll_CloseHandle]
mov eax, edi
call fcn.10016faf
ret

Function at 0x10020ab3
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
pushal
call 0x10020ac2
pop dword [ebp - 0x24]
mov eax, 0x51f299a0
add eax, 0xbe0f7122
sub dword [ebp - 0x24], eax
push 0x40
push 0x1000
push 0x3cffa
push 0
mov eax, 0x38dd4af8
add eax, 0xd725a664
add eax, dword [ebp - 0x24]
call dword [eax]
mov ecx, 0xa6574c13
add ecx, 0x59a8eef2
mov ebx, eax
mov edi, 0x1004ac00
add edi, dword [ebp - 0x24]
mov edx, 0x87305518
add edx, 0x71221e0c
mov dword [ebp - 0xc], 0x93c5ab13
mov esi, dword [edi]
xor dword [ebp - 0x10], esi
sub esi, edx
add dword [ebp - 8], eax
mov dword [ebx], esi
xor dword [ebp - 0x10], 0x7de431ac
add ebx, 0x398e958d
add ebx, 0xc6716a77
add edi, 0xc787530b
sub edi, 0xc7875307
loop 0x10020b1b
add eax, 0x6e6eb40d
sub eax, 0x6e6dd526
mov ebx, eax
add eax, 0x5931dacc
add eax, 0xa6ce2539
mov ecx, 0xd60bb842
sub ecx, 0xc60bb842
add ecx, dword [ebp - 0x24]
call ebx
leave
ret
Function at 0x430006
Capabilities:
Encode data using xor

Disassembly:
mov eax, section..pdata
nop
nop
nop
nop
push 4
nop
nop
pop edi
nop
nop
nop
nop
nop
nop
nop
cmp eax, 0
je 0x430072
nop
nop
nop
nop
mov ebx, 0x408f6c
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x659f7e99
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x430060
nop
nop
mov eax, section..pdata_1
nop
nop
cmp eax, 0
nop
nop
nop
je 0x4300d2
nop
nop
nop
mov ebx, 0x42e3d0
nop
nop
nop
nop
nop
mov ecx, ebx
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x49a532f7
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
nop
nop
add eax, edi
loop 0x4300c0
nop
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x401219
Function at 0x407701
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
pushal
call 0x407710
pop dword [ebp - 0x50]
mov eax, 0x7ad24e64
add eax, 0x856e28ac
sub dword [ebp - 0x50], eax
mov dword [ebp - 0x60], 0x15cf2373
add dword [ebp - 0x60], 0x388321d8
mov dword [ebp - 0x5c], 0xc659fdc1
sub dword [ebp - 0x5c], 0x9426b17c
mov dword [ebp - 0x58], 0x96e66b81
add dword [ebp - 0x58], 0xb565d8ad
mov dword [ebp - 0x54], 0x6a9445d9
add dword [ebp - 0x54], 0x956bba27
lea eax, [ebp - 0x60]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x50]
call dword [eax]
mov dword [ebp - 0x60], 0xe886e3d1
sub dword [ebp - 0x60], 0x74147a7b
mov dword [ebp - 0x5c], 0x49064509
sub dword [ebp - 0x5c], 0x799e394
mov dword [ebp - 0x58], 0xab147a35
add dword [ebp - 0x58], 0xb85af237
mov dword [ebp - 0x54], 0x2b8d7d1d
add dword [ebp - 0x54], 0xd47282e3
lea ebx, [ebp - 0x60]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x50]
call dword [eax]
push 0x40
push 0x1000
push 0x38c10
push 0
call eax
mov ecx, 0x9d03ecc5
sub ecx, 0x9d039e66
mov edx, eax
mov esi, 0x40ec00
add esi, dword [ebp - 0x50]
mov ebx, 0x987c8114
mov dword [ebp - 0x30], 0xac342503
mov edi, dword [esi]
sub edi, ebx
xor dword [ebp - 0xc], ebx
mov dword [edx], edi
xor dword [ebp - 0x30], edi
add edx, 4
add esi, 0x3c94c1af
sub esi, 0x3c94c1ab
loop 0x40781c
add eax, 0x15cb3a8a
add eax, 0xea35f1c5
mov ebx, eax
add eax, 0x1d89840f
sub eax, 0x1d89840a
mov ecx, 0x400000
add ecx, dword [ebp - 0x50]
call ebx
leave
ret
Function at 0x85e3a0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x342000]
push edi
or ebp, 0xffffffff
jmp 0x85e3c2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x85e3c9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x85e3b8
mov eax, 1
add ebx, ebx
jne 0x85e3db
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x85e3ec
jne 0x85e40b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x85e40b
dec eax
add ebx, ebx
jne 0x85e3f8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x85e3d0
add ebx, ebx
jne 0x85e407
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x85e45d
xor ecx, ecx
sub eax, 3
jb 0x85e423
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x85e492
sar eax, 1
mov ebp, eax
jmp 0x85e42e
add ebx, ebx
jne 0x85e42e
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x85e3fc
inc ecx
add ebx, ebx
jne 0x85e43c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x85e3fc
add ebx, ebx
jne 0x85e449
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x85e43e
jne 0x85e45a
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x85e43e
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x85e47c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x85e46e
jmp 0x85e3be
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x85e47c
add edi, ecx
jmp 0x85e3be
pop esi
mov edi, esi
mov ecx, 0xe01
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x85e49a
cmp byte [edi], 0x26
jne 0x85e49a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x85e49f
lea edi, [esi + 0x45c000]
mov eax, dword [edi]
or eax, eax
je 0x85e517
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x45e75c]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x45e798]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x85e4cc
mov ecx, edi
jns 0x85e4fb
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x45e79c]
or eax, eax
je 0x85e511
mov dword [ebx], eax
add ebx, 4
jmp 0x85e4e9
call dword [esi + 0x45e7a4]
mov ebp, dword [esi + 0x45e7a0]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1df]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x85e54b
sub esp, 0xffffff80
jmp 0x40aba4
Function at 0x403f5d
Capabilities:
Encode data using xor

Disassembly:
jl 0x403fb0
or dword [edx + 0x1154b606], 0xdc322449
pop ss
invalid
outsb dx, byte [esi]
retf
mov dh, 8
sbb al, 0xfd
dec ebp
jl 0x403f90
push ss
xchg ebp, eax
jae 0x403f5f
lds ebx, [0xd1066af3]
outsb dx, byte [esi]
fld dword [esi - 0x39]
add esp, esi
and edi, dword [esi + 0x6f8eae2b]
and dword [edx - 0x1e5a6154], 0x4f458cb2
jbe 0x40404a
mov edx, 0x36d667f3
fisubr word [ecx + esi*4]
mov bh, 0x89
ret
ret
Function at 0x10001050
Capabilities:
Encode data using xor

Disassembly:
movaps xmm1, xmmword [0x10018cb0]
xor eax, eax
test edx, edx
je 0x100010be
cmp edx, 0x10
jb 0x100010a1
push esi
mov esi, edx
and esi, 0xfffffff0
nop dword [eax + eax]
movups xmm0, xmmword [ecx]
add eax, 0x10
pxor xmm0, xmm1
paddb xmm0, xmm1
pxor xmm0, xmm1
paddb xmm0, xmm1
pxor xmm0, xmm1
paddb xmm0, xmm1
pxor xmm0, xmm1
movups xmmword [ecx], xmm0
add ecx, 0x10
cmp eax, esi
jb 0x10001070
pop esi
cmp eax, edx
jae 0x100010be
sub edx, eax
mov al, byte [ecx]
lea ecx, [ecx + 1]
xor al, 0x7b
add al, 0x7b
xor al, 0x7b
add al, 0x7b
xor al, 0x7b
add al, 0x7b
xor al, 0x7b
mov byte [ecx - 1], al
sub edx, 1
jne 0x100010a3
ret
Function at 0x10012a20
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x10012a4d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x10012a4d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x4c98e7
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
mov eax, 0x401000
call 0x4c98e7
lcall 0x5de5, 0x8b10c483
jmp fcn.0103791c