joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10cc81e
Capabilities:
Encrypt data using rc4 prga

Disassembly:
jmp 0x10e2701
call fcn.01131c35
xchg edx, eax
fnstenv [esi - 0x6de7e096]
aaa
mov al, byte [edx + 0x5b540dd9]
aad 0x70
fnsave dword [ecx - 0x4a]
sbb dword [ebx - 0x17a996de], esp
push ecx
loop 0x10b1ddb
mov bl, 0x72
imul esp, dword [esi - 0x1c], 0x8b85ca1d
dec edx
and eax, 0xbe522ee8
dec dword [ebp - 0x16f7db9c]
lea esp, [esp + 8]
jmp fcn.010b52dd
call fcn.010885a3
add ebp, 2
shr al, cl
jmp 0xc9e3ed
shr dword [eax], 1
insb byte es:[edi], dx
popfd
invalid
hlt
test ebp, ebp
lea esp, [esp + 8]
je 0xc476c3
push 0x762e323f
mov dword [esp], edi
mov edi, 0xa09ce623
movzx edi, byte [eax]
xor edi, ecx
and edi, 0xff
call fcn.00c313ab
xor edx, ebx
add edx, 0x3b2e253d
jmp 0x10b1d6d
jmp 0x11013b8
add ah, byte [ebx + ebx*2 - 0x40]
call fcn.010948c6
dec edx
cmp edx, dword [edi + esi*4]
jbe 0x11013b4
stosd dword es:[edi], eax
mov edx, 0x688b3295
or al, byte [edi]
mov bh, 0xe
invalid

Function at 0x10e2fe3
Capabilities:
Encode data using xor

Disassembly:
push esi
call fcn.00c30ba2
mov ecx, 0x58350ea4
mov ax, word [ebp + ecx - 0x58350ea4]
mov cx, word [ebp + ecx - 0x58350ea2]
call fcn.00c8c652
cwde
nop
test al, al
cmp byte [eax - 0x787cf58], bh
fdiv st(4)
pushfd
pop eax
fmul st(4)
add al, 0xac
fcom qword [esp]
rol al, 1
jg 0x10e3029
adc edx, dword [edi + 0x54]
xor al, 0x27
push ebx
mov bh, 0x8f
push esp
dec eax
mov ebx, 0x96e9ecab
sbb dh, byte [ebp + 0x38a77ff]
retf 0x2d9e
cmc
cmp byte [ecx], bh
pop eax
adc ebx, dword [ebp - 1]
invalid

Function at 0x10e497f
Capabilities:
Encrypt data using speck

Disassembly:
jae 0x10cc4f1
push 0xb2160d0b
lea esp, [esp + 8]
jmp fcn.010e173b
adc esi, 2
call fcn.00e15186
jmp 0x1102d71
sub eax, edx
mov edx, ebx
setb al
shr al, 0xc3
shl edx, 2
inc eax
call fcn.0113ae3e
mov ecx, 0xd617dfa4
mov dx, word [esi]
jmp 0x113c550
dec eax
lea esp, [esp + 0x20]
jmp fcn.010a9474
or cl, cl
jae 0x116cb98
sbb eax, ebp
mov eax, 0x370fb82e
jle 0x113c57d
cli
and bl, byte [esi]
adc dword [esi + 0x44], edx
pop esp
daa
sub eax, 0x7c70dd5d
lodsb al, byte [esi]
iretd
sti
cmp eax, 0xb6753b2a
ror ch, cl
sti
mov ebp, 0x6a75c456
push ebx
in eax, dx
sahf
or eax, 0xaf1253b1
inc ecx
invalid
not al
xor bl, al
mov dword [esp], esi
push ebx
mov edx, 0x433ddf05
movsx ebx, dl
mov ebx, eax
movsx eax, dx
jmp 0x10e496c
mov cl, byte [esi + 2]
jl 0x10944b1
cmc

Function at 0x1113c47
Capabilities:
Encrypt data using speck

Disassembly:
dec dl
call fcn.00c81657
xor dl, bl
xor dl, 0x88
mov dword [esp], ecx
jmp 0xc9e795

Function at 0x11329a0
Capabilities:
Encrypt data using speck

Disassembly:
xor ecx, edx
call fcn.01133385
mov dword [ebp], edx
jmp fcn.00e0f464
sal dword [esp + 0xa], 0xbc
xor edx, 0x52bcab1c
dec edi
lea esp, [esp + 0x10]
jne 0x113a63c
not edx
jmp 0x10fd519
movzx ecx, byte [eax]
jmp 0xc5473c

Function at 0x113705a
Capabilities:
Encode data using xor

Disassembly:
add esi, 4
movzx edx, byte [edi]
mov dword [esp], 0x5b1c5b1a
call fcn.01146c91
invalid
Function at 0x11596d5
Capabilities:
Encrypt data using speck

Disassembly:
mov dword [esp], 0x9c147eac
mov ax, word [ebp]
mov edx, 0xf1a5b788
shr edx, 0x6f
mov dx, word [ebp + edx*2 - 0x3c694]
call fcn.00e0f126
mov esi, 0xc5361596
movsx eax, si
mov esi, dword [eax + ebp - 0x1596]
lea eax, [eax + eax*4 + 0x43b912ac]
neg ax
movzx ax, byte ss:[esi + eax - 0x43b98166]
add ebp, 2
call fcn.0108e083
Function at 0x41b0b9
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor edi, edi
mov dword [ebp - 4], ecx
mov esi, edi
cmp dword [ebp + 8], esi
je 0x41b0fe
call fcn.00417bf4
push 0xf0
push dword [ebp + 8]
mov ebx, dword [eax + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x41b0fe
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
test esi, esi
je 0x41b11a
push esi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
mov ecx, dword [ebp - 4]
push edi
call fcn.0048ff4e
mov ebx, eax
test edi, edi
je 0x41b118
test esi, esi
je 0x41b118
push esi
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x41ba3a
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, ecx
push edi
test esi, esi
je 0x41baf8
cmp dword [esi + 0x20], 0
je 0x41baf8
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x41baf8
cmp dword [ebp + 8], 0
je 0x41baf8
xor eax, eax
mov ebx, eax
mov dword [ebp - 4], eax
mov dword [ebp - 8], ebx
mov edi, eax
call fcn.00417bf4
push 0x560408
push dword [ebp + 8]
mov eax, dword [eax + 0xc]
push eax
mov dword [ebp - 0xc], eax
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov dword [ebp + 8], eax
test eax, eax
je 0x41bac9
mov edi, dword [ebp - 0xc]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push dword [ebp + 8]
mov dword [ebp - 4], eax
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x41baf8
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
mov dword [ebp - 8], eax
push dword [ebp - 4]
push ebx
push esi
call fcn.00498bb7
add esp, 0xc
mov ebx, eax
cmp dword [ebp - 8], 0
je 0x41bae9
test edi, edi
je 0x41bae9
push edi
call dword [sym.imp.KERNEL32.dll_FreeResource]
test ebx, ebx
je 0x41baf4
mov ecx, esi
call fcn.0041b804
mov eax, ebx
jmp 0x41bafa
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x52b5a7
Capabilities:
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, ecx
push edi
mov eax, dword [esi]
call dword [eax + 0x178]
mov bx, word [ebp + 8]
mov edi, eax
push 2
movzx edx, bx
push edx
call dword [sym.imp.USER32.dll_MapVirtualKeyA]
cmp byte [ebp + 0xc], 0
jne 0x52b5e8
test edi, edi
js 0x52b5e8
cmp al, 0x20
je 0x52b5dd
cmp bx, 0x71
jne 0x52b5e8
mov eax, dword [esi]
mov ecx, esi
push edi
call dword [eax + 0x190]
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x549fe8
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00549ca8

Function at 0x416900
Capabilities:
Decompress data using aplib

Disassembly:
pushal
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x28]
cld
mov dl, 0x80
xor ebx, ebx
movsb byte es:[edi], byte [esi]
mov bl, 2
call fcn.0041698f
jae 0x41690e
xor ecx, ecx
call fcn.0041698f
jae 0x41693d
xor eax, eax
call fcn.0041698f
jae 0x41694d
mov bl, 2
inc ecx
mov al, 0x10
call fcn.0041698f
adc al, al
jae 0x41692f
jne 0x416979
stosb byte es:[edi], al
jmp 0x416911
call fcn.0041699b
sub ecx, ebx
jne 0x416956
call fcn.00416999
jmp 0x416975
lodsb al, byte [esi]
shr eax, 1
je 0x416983
adc ecx, ecx
jmp 0x416972
xchg ecx, eax
dec eax
shl eax, 8
lodsb al, byte [esi]
call fcn.00416999
cmp eax, 0x7d00
jae 0x416972
cmp ah, 5
jae 0x416973
cmp eax, 0x7f
ja 0x416974
inc ecx
inc ecx
xchg ebp, eax
mov eax, ebp
mov bl, 1
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x416911
sub edi, dword [esp + 0x28]
mov dword [esp + 0x1c], edi
popal
ret 8

Function at 0x408966
Capabilities:
Encode data using xor

Disassembly:
mov ecx, 0x4085d8
sub edx, edx
push 0xa29589cf
pop eax
call fcn.0040898b
sub eax, edx
xor dword [esi], ecx
add eax, eax
sub edx, eax
inc esi
and eax, eax
cmp esi, edi
jne fcn.00408966
add eax, eax
inc eax
ret
Function at 0x401219
Capabilities:
Terminate process

Disassembly:
mov eax, dword fs:[0]
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x40601c
push 0x40109a
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
push eax
fnstcw word [esp]
or word [esp], 0x300
fldcw word [esp]
add esp, 4
push 0
push 0
push 0x406028
push 0x406024
push 0x406020
call sub.CRTDLL.DLL___GetMainArgs
push dword [0x406028]
push dword [0x406024]
push dword [0x406020]
mov dword [0x406014], esp
call fcn.0040129c
add esp, 0x18
xor ecx, ecx
mov dword [ebp - 4], ecx
push eax
call sub.CRTDLL.DLL_exit
leave
ret

Function at 0x40129c
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x88
push ebx
push esi
push edi
xor esi, esi
mov dword [ebp - 0x84], 0
call fcn.00401994
mov esi, eax
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
mov eax, esi
or al, 0x40
push eax
lea eax, [0x4044a5]
lea edx, [fcn.00401a04]
sub eax, edx
push eax
push fcn.00401a04
call sub.KERNEL32.dll_VirtualProtect
cmp dword [ebp - 4], 0
je 0x401337
push esi
call fcn.0040188f
lea eax, [ebp - 0x84]
push eax
push esi
call fcn.004018dd
mov eax, esi
add eax, 0x1cc00
mov dword [ebp - 0x88], eax
lea eax, [ebp - 0x84]
push eax
mov edi, dword [ebp - 0x88]
mov eax, esi
mov ecx, edi
or cl, 1
cdq
idiv ecx
mov ebx, eax
add ebx, edi
push ebx
lea edi, [0x4060e4]
mov ebx, esi
dec ebx
and edi, ebx
push edi
call fcn.00401a04
add esp, 0x18
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x401994
Capabilities:
Encode data using base64 via winapi

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x224
push edi
and dword [ebp - 0x118], 0
xor edi, edi
mov dword [ebp - 0x114], 0xa
mov byte [ebp - 0x104], 0
lea eax, [ebp - 0x114]
push eax
lea eax, [ebp - 0x10e]
push eax
push 1
push 1
lea eax, [ebp - 0x104]
push eax
call sub.CRYPT32.DLL_CryptBinaryToStringA
call sub.KERNEL32.dll_GetLastError
push 0
push 0
call sub.SHLWAPI.DLL_PathAppendA
movsx edi, byte [ebp - 0x10e]
sub edi, 0x41
mov eax, edi
pop edi
leave
ret

Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40c7d0
mov ecx, 0x6e250301
nop
nop
test eax, eax
nop
nop
nop
je 0x43204e
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x432024
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x42f314
nop
mov ecx, 0x4ab45a0
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x432084
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x43206c
nop
nop
nop
popal
nop
nop
nop
jmp 0x431219
Function at 0x409a60
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x7000]
push edi
or ebp, 0xffffffff
jmp 0x409a82
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x409a89
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x409a78
mov eax, 1
add ebx, ebx
jne 0x409a9b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x409a90
jne 0x409aac
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x409a90
xor ecx, ecx
sub eax, 3
jb 0x409ac0
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x409b32
mov ebp, eax
add ebx, ebx
jne 0x409acb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x409ad8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x409afc
inc ecx
add ebx, ebx
jne 0x409ae8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x409add
jne 0x409af9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x409add
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x409b1c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x409b0d
jmp 0x409a7e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x409b1c
add edi, ecx
jmp 0x409a7e
pop esi
mov edi, esi
mov ecx, 0x1b
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x409b3a
cmp byte [edi], 0
jne 0x409b3a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x409b3f
lea edi, [esi + 0x7000]
mov eax, dword [edi]
or eax, eax
je 0x409bae
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x9000]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x903c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x409b6c
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x9040]
or eax, eax
je 0x409ba8
mov dword [ebx], eax
add ebx, 4
jmp 0x409b89
call dword [esi + 0x9048]
mov ebp, dword [esi + 0x9044]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1ff]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x409be2
sub esp, 0xffffff80
jmp 0x40185a
Function at 0x430006
Capabilities:
Encode data using xor

Disassembly:
call 0x43000c
nop
nop
nop
pop eax
nop
nop
add eax, 0x403daa
nop
sub eax, reloc.kernel32.dll_SleepEx
nop
nop
nop
mov ebx, dword [eax]
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x430030
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
jne 0x43001e
popal
nop
nop
nop
nop
nop
jmp fcn.00401219

Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
push 4
nop
nop
nop
nop
nop
nop
nop
nop
pop edi
nop
cmp eax, 0
nop
nop
nop
nop
nop
nop
je 0x42e072
nop
mov ebx, 0x407ef8
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
nop
nop
div edi
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x3ca47b5b
nop
nop
nop
nop
xor dword [eax], esi
nop
add eax, edi
nop
nop
nop
nop
loop 0x42e060
nop
nop
nop
nop
nop
mov eax, section..data
nop
nop
cmp eax, 0
nop
nop
nop
je 0x42e0d2
nop
nop
mov ebx, 0x42cd70
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
push eax
mov eax, ecx
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x5e500aad
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
loop 0x42e0c0
nop
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x401219
Function at 0x4035f3
Capabilities:
Query environment variable

Disassembly:
jmp 0x4f0027
mov edi, edi
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
jne 0x4f003b
xor edi, edi
jmp 0x4f007f
push ebx
push esi
call fcn.004eff20
push 0x40
mov ebx, eax
push str.minkernelcrtsucrt_srcdesktopcrtenvget_environment_from_os.cpp
sub ebx, esi
and ebx, 0xfffffffe
push 2
push ebx
call fcn.004052ea
mov edi, eax
add esp, 0x14
test edi, edi
je 0x4f006c
push ebx
push esi
push edi
call fcn.004054fc
add esp, 0xc
push 2
push 0
call fcn.00404cd2
pop ecx
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
pop ebx
mov eax, edi
pop edi
pop esi
ret

Function at 0x404e2b
Capabilities:
Encrypt data using rc4 prga

Disassembly:
jmp 0x507730
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff0
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0x40
cmp dword [0x550a00], 1
jge 0x50779f
mov eax, dword [ebx + 8]
movzx ecx, word [eax]
test ecx, ecx
je 0x507775
mov edx, dword [ebx + 8]
movzx eax, word [edx]
movzx ecx, word [ebx + 0xc]
cmp eax, ecx
je 0x507775
mov edx, dword [ebx + 8]
add edx, 2
mov dword [ebx + 8], edx
jmp 0x507752
mov eax, dword [ebx + 8]
movzx ecx, word [eax]
movzx edx, word [ebx + 0xc]
cmp ecx, edx
jne 0x50778b
mov eax, dword [ebx + 8]
mov dword [ebp - 4], eax
jmp 0x507792
mov dword [ebp - 4], 0
mov eax, dword [ebp - 4]
jmp 0x50788f
movzx ecx, word [ebx + 0xc]
movd xmm0, ecx
movaps xmmword [ebp - 0x30], xmm0
pshuflw xmm0, xmmword [ebp - 0x30], 0
movaps xmmword [ebp - 0x30], xmm0
pshufd xmm0, xmmword [ebp - 0x30], 0
movaps xmmword [ebp - 0x30], xmm0
mov edx, dword [ebx + 8]
and edx, 0xfff
cmp edx, 0xff0
ja 0x507860
mov eax, dword [ebx + 8]
movups xmm0, xmmword [eax]
movaps xmmword [ebp - 0x40], xmm0
movaps xmm0, xmmword [ebp - 0x20]
pxor xmm0, xmmword [ebp - 0x20]
movaps xmmword [ebp - 0x20], xmm0
movaps xmm0, xmmword [ebp - 0x20]
pcmpeqw xmm0, xmmword [ebp - 0x40]
movaps xmmword [ebp - 0x20], xmm0
movaps xmm0, xmmword [ebp - 0x40]
pcmpeqw xmm0, xmmword [ebp - 0x30]
movaps xmmword [ebp - 0x40], xmm0
movaps xmm0, xmmword [ebp - 0x20]
por xmm0, xmmword [ebp - 0x40]
movaps xmmword [ebp - 0x20], xmm0
movaps xmm0, xmmword [ebp - 0x20]
pmovmskb ecx, xmm0
mov dword [ebp - 8], ecx
cmp dword [ebp - 8], 0
je 0x507855
bsf edx, dword [ebp - 8]
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x10]
add eax, dword [ebx + 8]
mov dword [ebx + 8], eax
mov ecx, dword [ebx + 8]
movzx edx, word [ecx]
movzx eax, word [ebx + 0xc]
cmp edx, eax
jne 0x507849
mov ecx, dword [ebx + 8]
mov dword [ebp - 0xc], ecx
jmp 0x507850
mov dword [ebp - 0xc], 0
mov eax, dword [ebp - 0xc]
jmp 0x50788f
mov edx, dword [ebx + 8]
add edx, 0x10
mov dword [ebx + 8], edx
jmp 0x50788a
mov eax, dword [ebx + 8]
movzx ecx, word [eax]
movzx edx, word [ebx + 0xc]
cmp ecx, edx
jne 0x507873
mov eax, dword [ebx + 8]
jmp 0x50788f
mov eax, dword [ebx + 8]
movzx ecx, word [eax]
test ecx, ecx
jne 0x507881
xor eax, eax
jmp 0x50788f
mov edx, dword [ebx + 8]
add edx, 2
mov dword [ebx + 8], edx
jmp 0x5077bf
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
Function at 0x5e21e0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x18b000]
push edi
jmp 0x5e21fa
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x5e2201
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x5e21f0
mov eax, 1
add ebx, ebx
jne 0x5e2213
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x5e2224
jne 0x5e2243
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x5e2243
dec eax
add ebx, ebx
jne 0x5e2230
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x5e2208
add ebx, ebx
jne 0x5e223f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x5e2295
xor ecx, ecx
sub eax, 3
jb 0x5e225b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x5e22ca
sar eax, 1
mov ebp, eax
jmp 0x5e2266
add ebx, ebx
jne 0x5e2266
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x5e2234
inc ecx
add ebx, ebx
jne 0x5e2274
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x5e2234
add ebx, ebx
jne 0x5e2281
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x5e2276
jne 0x5e2292
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x5e2276
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x5e22b4
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x5e22a6
jmp 0x5e21f6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x5e22b4
add edi, ecx
jmp 0x5e21f6
pop esi
mov edi, esi
mov ecx, 0x3ea9
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x5e22d2
cmp byte [edi], 0x11
jne 0x5e22d2
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x5e22d7
lea edi, [esi + 0x1db000]
mov eax, dword [edi]
or eax, eax
je 0x5e234f
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x2ebbe4]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x2ebd60]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x5e2304
mov ecx, edi
jns 0x5e2333
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x2ebd64]
or eax, eax
je 0x5e2349
mov dword [ebx], eax
add ebx, 4
jmp 0x5e2321
call dword [esi + 0x2ebd74]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x5e2380
cmp al, 0xef
ja 0x5e2373
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x5e2355
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x5e2362
mov ebp, dword [esi + 0x2ebd68]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x22f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x5e23b4
sub esp, 0xffffff80
jmp 0x42800a
Function at 0x4bb010
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x1b
mov dword [esp + 4], 1
lea ebx, [esp + 0x24]
mov dword [esp], str.Mingw_w64_runtime_failure:_n
add eax, 0x40
mov dword [esp + 0xc], eax
call sub.msvcrt.dll_fwrite
mov eax, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp + 4], eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
jmp fcn.004bb070

Function at 0x4bb070
Capabilities:
Allocate or change rwx memory

Disassembly:
push edi
push esi
push ebx
sub esp, 0x30
mov esi, dword [0x4be3a0]
test esi, esi
jle 0x4bb163
mov edi, dword [0x4be3a4]
xor ebx, ebx
lea edx, [edi + 0xc]
nop
mov ecx, dword [edx]
cmp ecx, eax
ja 0x4bb0a4
mov edi, dword [edx + 4]
add ecx, dword [edi + 8]
cmp eax, ecx
jb 0x4bb15c
add ebx, 1
add edx, 0x14
cmp ebx, esi
jne 0x4bb090
mov dword [esp], eax
mov esi, eax
call fcn.004bb960
test eax, eax
mov edi, eax
je 0x4bb1a0
mov esi, dword [0x4be3a4]
lea ebx, [ebx + ebx*4]
shl ebx, 2
add esi, ebx
mov dword [esi + 0x10], eax
mov dword [esi], 0
call fcn.004bba70
add eax, dword [edi + 0xc]
mov dword [esi + 0xc], eax
lea eax, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], eax
mov eax, dword [0x4be3a4]
mov eax, dword [eax + ebx + 0xc]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x4bb180
mov eax, dword [esp + 0x28]
lea edx, [eax - 0x40]
and edx, 0xffffffbf
je 0x4bb155
sub eax, 4
and eax, 0xfffffffb
je 0x4bb155
add ebx, dword [0x4be3a4]
mov eax, dword [esp + 0x14]
mov edx, dword [esp + 0x20]
mov dword [ebx + 4], eax
mov dword [ebx + 8], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 8], 0x40
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
je 0x4bb16a
add dword [0x4be3a0], 1
add esp, 0x30
pop ebx
pop esi
pop edi
ret
xor ebx, ebx
jmp 0x4bb0ae
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call fcn.004bb010
mov eax, dword [0x4be3a4]
mov eax, dword [eax + ebx + 0xc]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call fcn.004bb010
mov dword [esp + 4], esi
mov dword [esp], str.Address__p_has_no_image_section
call fcn.004bb010
Function at 0x4bb5e0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0x4be3b8
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0x4be3b0]
sub esp, 4
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
test ebx, ebx
je 0x4bb635
lea esi, [esi]
mov eax, dword [ebx]
mov dword [esp], eax
call ebp
sub esp, 4
mov esi, eax
call edi
test eax, eax
jne 0x4bb62e
test esi, esi
je 0x4bb62e
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x4bb610
mov dword [esp], 0x4be3b8
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret