joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4173e0
Capabilities:
Create thread
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x444e2d
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x455100]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x4570f0
mov dword [ebp - 0x2c], 0x4570f0
mov byte [ebp - 0x28], 0
call fcn.0041f1ef
add esp, 4
test eax, eax
jne 0x41754a
cmp dword [0x45711c], 0x7fffffff
je 0x417551
mov byte [ebp - 0x28], 1
mov dword [ebp - 0x24], 0x4570d0
mov dword [ebp - 4], eax
movzx eax, byte [ebp + 8]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [ebp + 9]
xor ecx, eax
movzx eax, byte [ebp + 0xa]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [ebp + 0xb]
imul ecx, ecx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, 0x4570d0
push eax
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.00411ed0
mov eax, dword [eax + 4]
test eax, eax
je 0x41752e
cmp eax, dword [0x4570d4]
je 0x41752e
lea eax, [ebp + 8]
mov ecx, 0x4570d0
push eax
call fcn.00419700
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
mov dword [ebp - 0x20], 1
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x14], edx
movups xmm0, xmmword [ebp - 0x20]
push 0x18
mov dword [ebp - 0x44], eax
movups xmmword [ebp - 0x3c], xmm0
call fcn.0041f72c
add esp, 4
test eax, eax
je 0x4174ed
movups xmm0, xmmword [ebp - 0x44]
movups xmmword [eax], xmm0
movq xmm0, qword [ebp - 0x34]
movq qword [eax + 0x10], xmm0
jmp 0x4174ef
xor eax, eax
mov dword [ebp - 0x10], eax
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 1
push ecx
push 0
push eax
push 0x412210
push 0
push 0
call fcn.0042e4a5
add esp, 0x18
mov dword [ebp - 0x18], eax
test eax, eax
je 0x417569
mov ecx, dword [ebp - 0x14]
mov byte [ebp - 4], 2
test ecx, ecx
je 0x417562
push ecx
push eax
call fcn.0041cf6f
add esp, 8
test eax, eax
jne 0x417562
push 0x4570f0
call fcn.0041f200
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 5
call fcn.0041d242
push 6
mov dword [0x45711c], 0x7ffffffe
call fcn.0041d242
push 1
call fcn.0041d242
push 6
mov dword [ebp - 0x14], 0
call fcn.0041d242
int3
Function at 0x4180f0
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x444fe0
mov eax, dword fs:[0]
push eax
sub esp, 0x454
mov eax, dword [0x455100]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
push 0x4473a8
push str.kernel32.dll
push ebx
mov dword [ebp - 0x460], ebx
mov dword [ebp - 0x45c], 0
call fcn.00415b30
push edx
push eax
push ebx
call fcn.00415e30
mov ecx, dword [0x456f58]
mov dword [ebp - 0x458], eax
or eax, edx
mov dword [ebp - 0x454], edx
mov dword [ebp - 0x450], 0
mov dword [ebp - 0x44c], 0xffffffff
mov dword [ebp - 0x448], ecx
jne 0x41823c
test ebx, ebx
mov eax, ebx
cmove eax, dword [0x456f54]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessId]
push eax
push 0x18
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
cmp esi, 0xffffffff
je 0x418202
push 0x424
lea eax, [ebp - 0x434]
mov dword [ebp - 0x438], 0x428
push 0
push eax
call fcn.004215c0
add esp, 0xc
lea eax, [ebp - 0x438]
push eax
push esi
call sub.KERNEL32.dll_Module32FirstW
test eax, eax
je 0x4181fb
lea eax, [ebp - 0x418]
push str.kernel32.dll
push eax
call fcn.004247bf
add esp, 8
test eax, eax
je 0x41825f
lea eax, [ebp - 0x438]
push eax
push esi
call sub.KERNEL32.dll_Module32NextW
test eax, eax
jne 0x4181d2
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xorps xmm0, xmm0
movlpd qword [ebp - 0x440], xmm0
mov eax, dword [ebp - 0x440]
mov edx, dword [ebp - 0x43c]
push 0x4473a8
push edx
push eax
push ebx
call fcn.004162c0
mov dword [ebp - 0x458], eax
mov dword [ebp - 0x454], edx
mov dword [ebp - 0x448], 0
cmp dword [edi + 0x14], 7
mov dword [ebp - 4], 0
jbe 0x41824b
mov edi, dword [edi]
push edi
lea ecx, [ebp - 0x460]
call fcn.004117f0
or eax, edx
je 0x41826f
mov bl, 1
jmp 0x418271
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x41c]
cdq
jmp 0x418219
xor bl, bl
mov esi, dword [ebp - 0x45c]
mov dword [ebp - 4], 0xffffffff
test esi, esi
je 0x4182b7
mov edx, dword [esi + 8]
mov eax, edx
mov ecx, dword [esi + 0xc]
or eax, ecx
mov dword [ebp - 4], 1
je 0x4182ac
cmp dword [esi], 0
je 0x4182ac
push 0x4000
push dword [esi + 0x10]
push ecx
push edx
push dword [esi + 4]
call fcn.00418470
push 0x18
push esi
call fcn.0041f75c
add esp, 8
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0041fbbb
mov esp, ebp
pop ebp
ret
Function at 0x41b170
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x445215
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
push ebx
push esi
push edi
mov eax, dword [0x455100]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x18], ebx
mov edi, dword [ebp + 8]
cmp edi, dword [ebp + 0xc]
je 0x41b34a
nop dword [eax]
movzx eax, byte [edi]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [edi + 1]
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, ebx
push eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x20]
push edi
push eax
call fcn.0041b100
cmp dword [ebp - 0x1c], 0
jne 0x41b33b
cmp dword [ebx + 8], 0x15555555
je 0x41b35e
lea eax, [ebx + 4]
mov dword [ebp - 0x28], eax
push 0xc
mov dword [ebp - 4], 0
mov dword [ebp - 0x24], 0
call fcn.0041f72c
mov cx, word [edi]
mov esi, eax
add esp, 4
mov dword [ebp - 0x24], esi
mov word [esi + 8], cx
mov ecx, dword [ebx + 8]
mov eax, dword [ebx + 0x1c]
inc ecx
mov dword [ebp - 0x14], eax
movss xmm3, dword [ebx]
mov dword [ebp - 4], 1
movd xmm0, ecx
cvtdq2pd xmm0, xmm0
shr ecx, 0x1f
addsd xmm0, qword [ecx*8 + 0x447550]
cvtpd2ps xmm2, xmm0
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
movaps xmm1, xmm2
addsd xmm0, qword [eax*8 + 0x447550]
cvtpd2ps xmm0, xmm0
divss xmm1, xmm0
comiss xmm1, xmm3
jbe 0x41b2e2
divss xmm2, xmm3
sub esp, 8
cvtps2pd xmm0, xmm2
movsd qword [ebp - 0x30], xmm0
fld qword [ebp - 0x30]
fstp qword [esp]
call fcn.0042eae0
fstp qword [ebp - 0x30]
movsd xmm0, qword [ebp - 0x30]
add esp, 8
cvtpd2ps xmm0, xmm0
call fcn.0041ff50
mov ecx, 8
cmp eax, ecx
cmova ecx, eax
mov eax, dword [ebp - 0x14]
cmp eax, ecx
jae 0x41b2bb
cmp eax, 0x200
jae 0x41b2b9
shl eax, 3
cmp eax, ecx
jae 0x41b2bb
mov eax, ecx
push eax
mov ecx, ebx
call fcn.0041c740
push dword [ebp - 0x10]
lea eax, [esi + 8]
mov ecx, ebx
push eax
lea eax, [ebp - 0x38]
push eax
call fcn.0041b100
mov edx, dword [eax]
mov eax, dword [eax + 4]
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x1c], eax
jmp 0x41b2e5
mov edx, dword [ebp - 0x20]
mov eax, dword [edx + 4]
inc dword [ebx + 8]
mov edi, dword [ebp - 0x28]
mov dword [esi + 4], eax
mov dword [esi], edx
mov dword [eax], esi
mov dword [edx + 4], esi
mov ecx, dword [ebx + 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebx + 0x18]
and eax, dword [ebp - 0x10]
mov dword [ebp - 0x24], 0
mov ebx, dword [ecx + eax*8]
cmp ebx, dword [edi]
mov edi, dword [ebp + 8]
mov ebx, dword [ebp - 0x18]
jne 0x41b31d
mov dword [ecx + eax*8], esi
jmp 0x41b330
cmp dword [ecx + eax*8], edx
jne 0x41b327
mov dword [ecx + eax*8], esi
jmp 0x41b334
mov edx, dword [ebp - 0x14]
cmp dword [ecx + eax*8 + 4], edx
jne 0x41b334
mov dword [ecx + eax*8 + 4], esi
mov dword [ebp - 4], 0xffffffff
add edi, 2
mov dword [ebp + 8], edi
cmp edi, dword [ebp + 0xc]
jne 0x41b1b0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
push str.unordered_map_set_too_long
call fcn.0041cee9
int3
Function at 0x420633
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x420672
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x420672
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x420672
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x420672
cmp dword [ecx + 0x74], 0xe
jbe 0x420672
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x43477d
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x44bc94
push 0x44bc8c
push str.FlsAlloc
push 0x1e
call fcn.004345aa
mov esi, eax
add esp, 0x10
test esi, esi
je 0x4347b1
push dword [ebp + 8]
mov ecx, esi
call dword [0x4461dc]
call esi
jmp 0x4347b7
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x4347fb
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x44bca4
push 0x44bc9c
push str.FlsGetValue
push 0x20
call fcn.004345aa
mov esi, eax
add esp, 0x10
test esi, esi
je 0x434832
push dword [ebp + 8]
mov ecx, esi
call dword [0x4461dc]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]
Function at 0x438fde
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00438c79

Function at 0x438fe9
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00438e08

Function at 0x43943f
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x101c
call fcn.0041fbd0
mov eax, dword [0x455100]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push ebx
push dword [ebp + 8]
mov dword [ebp - 0x100c], eax
call fcn.0042df52
pop ecx
mov ecx, dword [ebp + 8]
mov ebx, eax
cmp dword [ecx + 8], 0
jne 0x439481
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
jmp 0x4395dd
mov eax, dword [ecx]
sub eax, dword [ecx + 4]
push esi
push edi
push 0
cdq
push 2
push edx
push eax
call fcn.00443430
push dword [ebp - 0x100c]
mov ecx, ebx
mov dword [ebp - 0x1008], eax
mov esi, ebx
mov dword [ebp - 0x1018], edx
and ecx, 0x3f
sar esi, 6
imul edi, ecx, 0x38
push 0
mov eax, dword [esi*4 + 0x457e00]
push dword [edi + eax + 0x24]
push dword [edi + eax + 0x20]
push ebx
call fcn.00439865
mov ecx, dword [esi*4 + 0x457e00]
add esp, 0x14
mov dword [ebp - 0x1010], eax
mov eax, edx
mov edx, dword [ebp - 0x1010]
mov dword [ebp - 0x101c], eax
cmp edx, dword [edi + ecx + 0x20]
jne 0x4395d6
cmp eax, dword [edi + ecx + 0x24]
jne 0x4395d6
push 0
lea eax, [ebp - 0x1014]
push eax
push 0x1000
lea eax, [ebp - 0x1004]
push eax
push dword [edi + ecx + 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4395d6
push dword [ebp - 0x100c]
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.00439865
add esp, 0x14
test edx, edx
jl 0x4395d6
jg 0x43954c
test eax, eax
jb 0x4395d6
mov ebx, dword [ebp - 0x1018]
mov eax, dword [ebp - 0x1014]
test ebx, ebx
jg 0x4395d6
jl 0x439566
cmp dword [ebp - 0x1008], eax
ja 0x4395d6
lea edi, [ebp - 0x1004]
xor edx, edx
add edi, eax
lea ecx, [ebp - 0x1004]
xor esi, esi
cmp dword [ebp - 0x1008], edx
jne 0x439584
test ebx, ebx
je 0x4395bd
cmp ecx, edi
jae 0x4395bd
mov al, byte [ecx]
cmp al, 0xd
jne 0x43959e
lea eax, [edi - 1]
cmp ecx, eax
jae 0x4395aa
cmp byte [ecx + 1], 0xa
jne 0x4395aa
inc ecx
jmp 0x4395aa
movzx eax, al
movsx eax, byte [eax + 0x455a80]
add ecx, eax
add esi, 1
adc edx, 0
inc ecx
cmp esi, dword [ebp - 0x1008]
jne 0x439584
cmp edx, ebx
jne 0x439584
lea eax, [ebp - 0x1004]
sub ecx, eax
mov eax, ecx
cdq
add eax, dword [ebp - 0x1010]
adc edx, dword [ebp - 0x101c]
jmp 0x4395db
or edx, 0xffffffff
mov eax, edx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.0041fbbb
leave
ret
Function at 0x43fac3
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
sar ecx, 6
push esi
push edi
imul edi, eax, 0x38
mov eax, dword [ecx*4 + 0x457e00]
mov dword [ebp - 0x10], ecx
mov ecx, dword [eax + edi + 0x18]
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x43fb03
cmp byte [ebx], 0xa
jne 0x43fb03
or byte [eax + edi + 0x28], 4
jmp 0x43fb08
and byte [eax + edi + 0x28], 0xfb
add ecx, ebx
mov edx, ebx
mov dword [ebp - 0xc], ecx
mov esi, ebx
cmp ebx, ecx
jae 0x43fc06
mov al, byte [edx]
cmp al, 0x1a
je 0x43fbe8
lea ecx, [edx + 1]
mov dword [ebp - 8], ecx
mov ecx, dword [ebp - 0xc]
cmp al, 0xd
je 0x43fb37
mov edx, dword [ebp - 8]
mov byte [esi], al
jmp 0x43fb5c
mov eax, dword [ebp - 8]
cmp eax, ecx
jae 0x43fb66
mov cl, byte [eax]
xor eax, eax
cmp cl, 0xa
sete al
inc eax
add edx, eax
cmp cl, 0xa
sete al
dec al
and al, 3
add al, 0xa
mov byte [esi], al
mov ecx, dword [ebp - 0xc]
inc esi
cmp edx, ecx
jb 0x43fb19
jmp 0x43fc06
push 0
lea eax, [ebp - 0xc]
push eax
push 1
lea eax, [ebp - 1]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x43fbe3
cmp dword [ebp - 0xc], 0
je 0x43fbe3
mov ecx, dword [ebp - 0x10]
mov eax, dword [ecx*4 + 0x457e00]
test byte [eax + edi + 0x28], 0x48
je 0x43fbbd
mov dl, byte [ebp - 1]
lea eax, [esi + 1]
mov dword [ebp - 0x14], eax
cmp dl, 0xa
jne 0x43fba8
mov byte [esi], dl
jmp 0x43fbb9
mov byte [esi], 0xd
mov eax, dword [ecx*4 + 0x457e00]
mov byte [eax + edi + 0x2a], dl
mov eax, dword [ebp - 0x14]
mov esi, eax
jmp 0x43fc06
cmp byte [ebp - 1], 0xa
jne 0x43fbcc
cmp esi, ebx
jne 0x43fbcc
mov byte [esi], 0xa
jmp 0x43fc05
push 1
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.00439883
add esp, 0x10
cmp byte [ebp - 1], 0xa
je 0x43fc06
mov byte [esi], 0xd
jmp 0x43fc05
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ecx*4 + 0x457e00]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x43fc02
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x43fc06
mov byte [esi], 0x1a
inc esi
sub esi, ebx
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x43fc0f
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov ebx, eax
and eax, 0x3f
sar ebx, 6
push edi
imul edi, eax, 0x38
push 0xa
mov eax, dword [ebx*4 + 0x457e00]
pop edx
mov dword [ebp - 0x14], edx
mov ecx, dword [edi + eax + 0x18]
mov dword [ebp - 0x18], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x43fc52
cmp word [esi], dx
jne 0x43fc52
or byte [edi + eax + 0x28], 4
jmp 0x43fc57
and byte [edi + eax + 0x28], 0xfb
lea edx, [esi + ecx*2]
mov eax, esi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
cmp eax, edx
jae 0x43fd90
mov dword [ebp - 0xc], 0xd
movzx ecx, word [eax]
mov edx, ecx
mov dword [ebp - 0x10], edx
push 0x1a
pop edx
cmp cx, dx
mov edx, dword [ebp - 8]
je 0x43fd70
add eax, 2
cmp cx, word [ebp - 0xc]
je 0x43fc99
mov dword [ebp - 4], eax
mov word [esi], cx
jmp 0x43fccf
cmp eax, edx
jae 0x43fcdb
movzx eax, word [eax]
xor ecx, ecx
cmp ax, word [ebp - 0x14]
mov edx, eax
push 0xa
sete cl
xor eax, eax
lea ecx, [ecx*2 + 2]
add dword [ebp - 4], ecx
pop ecx
cmp dx, cx
mov edx, dword [ebp - 8]
sete al
dec eax
and eax, 3
add eax, ecx
mov word [esi], ax
mov eax, dword [ebp - 4]
add esi, 2
cmp eax, edx
jb 0x43fc71
jmp 0x43fd90
push 0
lea eax, [ebp - 0x14]
push eax
push 2
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x43fd6c
cmp dword [ebp - 0x14], 0
je 0x43fd6c
mov eax, dword [ebx*4 + 0x457e00]
push 0xa
test byte [edi + eax + 0x28], 0x48
je 0x43fd44
mov cx, word [ebp - 4]
pop eax
cmp cx, ax
je 0x43fd8a
push 0xd
pop eax
mov word [esi], ax
mov eax, dword [ebx*4 + 0x457e00]
push 0xa
mov byte [edi + eax + 0x2a], cl
mov eax, dword [ebx*4 + 0x457e00]
shr cx, 8
mov byte [edi + eax + 0x2b], cl
mov eax, dword [ebx*4 + 0x457e00]
pop ecx
mov byte [edi + eax + 0x2c], cl
jmp 0x43fd8d
pop ebx
cmp word [ebp - 4], bx
jne 0x43fd55
cmp esi, dword [ebp + 0xc]
jne 0x43fd55
mov word [esi], bx
jmp 0x43fd8d
push 1
push 0xffffffffffffffff
push 0xfffffffffffffffe
push dword [ebp + 8]
call fcn.00439883
add esp, 0x10
cmp word [ebp - 4], bx
je 0x43fd90
push 0xd
jmp 0x43fd89
mov ecx, dword [ebx*4 + 0x457e00]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x43fd87
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x43fd90
push 0x1a
pop eax
mov word [esi], ax
add esi, 2
sub esi, dword [ebp + 0xc]
and esi, 0xfffffffe
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x52d6f0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0xd0000]
push edi
jmp 0x52d70a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x52d711
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x52d700
mov eax, 1
add ebx, ebx
jne 0x52d723
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x52d734
jne 0x52d753
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x52d753
dec eax
add ebx, ebx
jne 0x52d740
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x52d718
add ebx, ebx
jne 0x52d74f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x52d7a5
xor ecx, ecx
sub eax, 3
jb 0x52d76b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x52d7da
sar eax, 1
mov ebp, eax
jmp 0x52d776
add ebx, ebx
jne 0x52d776
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x52d744
inc ecx
add ebx, ebx
jne 0x52d784
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x52d744
add ebx, ebx
jne 0x52d791
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x52d786
jne 0x52d7a2
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x52d786
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x52d7c4
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x52d7b6
jmp 0x52d706
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x52d7c4
add edi, ecx
jmp 0x52d706
pop esi
mov edi, esi
mov ecx, 0x40f0
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x52d7e2
cmp byte [edi], 0x11
jne 0x52d7e2
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x52d7e7
lea edi, [esi + 0x126000]
mov eax, dword [edi]
or eax, eax
je 0x52d85f
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x175164]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x1752e0]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x52d814
mov ecx, edi
jns 0x52d843
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x1752e4]
or eax, eax
je 0x52d859
mov dword [ebx], eax
add ebx, 4
jmp 0x52d831
call dword [esi + 0x1752f4]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x52d890
cmp al, 0xef
ja 0x52d883
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x52d865
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x52d872
mov ebp, dword [esi + 0x1752e8]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x23f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x52d8c4
sub esp, 0xffffff80
jmp 0x420577
Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40de38
nop
mov ecx, 0x159814cb
nop
nop
nop
test eax, eax
nop
nop
je 0x43304e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
nop
jne 0x433024
nop
mov eax, section..data
nop
mov ebx, 0x4304d8
nop
mov ecx, 0x431344bf
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x433084
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x43306c
nop
nop
nop
nop
nop
popal
nop
jmp 0x431219
Function at 0x4051e0
Capabilities:
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x477d3b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x180
push ebx
push ebp
mov ebp, ecx
lea ecx, [esp + 8]
lea eax, [ebp + 0x40]
push eax
call fcn.0047024c
mov ecx, dword [esp + 8]
mov dword [esp + 0x190], 0
mov eax, dword [ecx - 8]
test eax, eax
je 0x405262
lea edx, [esp + 0x10]
push 1
push edx
lea ecx, [esp + 0x10]
call fcn.0046ac5e
mov eax, dword [eax]
push 0x492b70
push eax
call fcn.0045d74a
add esp, 8
lea ecx, [esp + 0x10]
test eax, eax
setne bl
call fcn.004704d7
test bl, bl
je 0x405262
push 0x492b70
lea ecx, [esp + 0xc]
call fcn.00470867
push 0x492b7c
lea ecx, [esp + 0xc]
call fcn.00470867
mov ecx, dword [esp + 8]
lea eax, [esp + 0x48]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
jne 0x40529e
lea ecx, [esp + 8]
mov dword [esp + 0x190], eax
call fcn.004704d7
jmp 0x405369
push esi
mov esi, dword [esp + 0x19c]
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
mov ebx, 0x23
test byte [esp + 0x50], 0x10
je 0x405322
lea edx, [esp + 0x7c]
push 0x492b78
push edx
call fcn.0045d74a
add esp, 8
test eax, eax
je 0x405322
lea eax, [esp + 0x7c]
push 0x492b74
push eax
call fcn.0045d74a
add esp, 8
test eax, eax
je 0x405322
mov eax, dword [ebp + 0x1c]
lea edx, [esp + 0x1c]
push edx
push 0
lea ecx, [esp + 0x84]
push 0x1100
push eax
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], 0xffff0003
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 1
mov dword [esp + 0x44], ecx
mov dword [esp + 0x34], ebx
call edi
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x50]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x4052b2
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp + 0x1c]
push esi
push 2
push 0x1102
push ecx
call edi
lea ecx, [esp + 0x10]
mov dword [esp + 0x198], 0xffffffff
call fcn.004704d7
pop edi
pop esi
mov ecx, dword [esp + 0x188]
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18c
ret 4

Function at 0x405b60
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
sub esp, 0x10c
lea eax, [esp]
push esi
push eax
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x405bc2
mov edx, dword [esp + 4]
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push eax
push ecx
push esi
push edx
mov dword [esp + 0x18], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov ecx, dword [esp + 0x11c]
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x10c
ret 0xc