joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4bb0f5
Capabilities:
Set environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
push ebx
xor ebx, ebx
cmp eax, ebx
push edi
mov dword [ebp - 0x10], ebx
jne 0x4bb10e
or eax, 0xffffffff
jmp 0x4bb16f
push esi
mov esi, dword [eax]
cmp esi, ebx
mov dword [ebp - 8], esi
je 0x4bb16b
push 0x3d
push esi
call fcn.004bb2f6
cmp eax, ebx
pop ecx
pop ecx
mov dword [ebp - 0xc], eax
je 0x4bb16b
cmp esi, eax
je 0x4bb16b
xor ecx, ecx
cmp byte [eax + 1], cl
mov eax, dword [0x4d8f50]
sete cl
cmp eax, dword [0x4d8f54]
mov dword [ebp - 4], ecx
jne 0x4bb151
mov edi, eax
call fcn.004bb094
mov dword [0x4d8f50], eax
cmp eax, ebx
jne 0x4bb1aa
cmp dword [ebp + 0xc], ebx
je 0x4bb173
cmp dword [0x4d8f58], ebx
je 0x4bb173
call fcn.004ba50c
test eax, eax
je 0x4bb1aa
or eax, 0xffffffff
pop esi
pop edi
pop ebx
leave
ret
cmp dword [ebp - 4], ebx
je 0x4bb17c
xor eax, eax
jmp 0x4bb16e
push 4
call fcn.004ab554
cmp eax, ebx
pop ecx
mov dword [0x4d8f50], eax
je 0x4bb16b
mov dword [eax], ebx
cmp dword [0x4d8f58], ebx
jne 0x4bb1aa
push 4
call fcn.004ab554
cmp eax, ebx
pop ecx
mov dword [0x4d8f58], eax
je 0x4bb16b
mov dword [eax], ebx
mov edi, dword [ebp - 0xc]
mov ebx, dword [0x4d8f50]
sub edi, esi
push esi
call fcn.004bb047
mov edi, eax
test edi, edi
pop ecx
jl 0x4bb211
cmp dword [ebx], 0
je 0x4bb211
lea esi, [ebx + edi*4]
push dword [esi]
call fcn.004ab0ef
xor eax, eax
cmp dword [ebp - 4], eax
pop ecx
jne 0x4bb1f1
mov ecx, dword [ebp - 8]
mov dword [esi], ecx
mov ecx, dword [ebp + 8]
mov esi, dword [ebp - 8]
mov dword [ecx], eax
jmp 0x4bb252
mov ecx, dword [esi + 4]
inc edi
mov dword [esi], ecx
lea esi, [ebx + edi*4]
cmp dword [esi], eax
jne 0x4bb1e8
mov eax, edi
shl eax, 2
push eax
push dword [0x4d8f50]
call fcn.004ad23a
test eax, eax
mov esi, dword [ebp - 8]
pop ecx
pop ecx
je 0x4bb252
jmp 0x4bb24d
cmp dword [ebp - 4], 0
jne 0x4bb2b9
test edi, edi
jge 0x4bb221
neg edi
lea eax, [edi*4 + 8]
push eax
push dword [0x4d8f50]
call fcn.004ad23a
test eax, eax
pop ecx
pop ecx
je 0x4bb16b
lea ecx, [eax + edi*4]
and dword [ecx + 4], 0
mov dword [ecx], esi
mov ecx, dword [ebp + 8]
and dword [ecx], 0
mov dword [0x4d8f50], eax
cmp dword [ebp + 0xc], 0
je 0x4bb2a4
push esi
call fcn.004ae430
inc eax
inc eax
push eax
call fcn.004ab554
mov edi, eax
test edi, edi
pop ecx
pop ecx
je 0x4bb2a4
push esi
push edi
call fcn.004aa170
mov eax, edi
sub eax, esi
add eax, dword [ebp - 0xc]
pop ecx
pop ecx
mov ecx, dword [ebp - 4]
mov byte [eax], 0
inc eax
neg ecx
sbb ecx, ecx
not ecx
and ecx, eax
push ecx
push edi
call dword [sym.imp.KERNEL32.DLL_SetEnvironmentVariableA]
test eax, eax
jne 0x4bb29d
or dword [ebp - 0x10], 0xffffffff
push edi
call fcn.004ab0ef
pop ecx
cmp dword [ebp - 4], 0
je 0x4bb2b1
push esi
call fcn.004ab0ef
pop ecx
mov eax, dword [ebp - 0x10]
jmp 0x4bb16e
push esi
call fcn.004ab0ef
mov eax, dword [ebp + 8]
and dword [eax], 0
pop ecx
jmp 0x4bb178
Function at 0x40dc5d
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
lea edx, [ecx + 0x18]
add edx, eax
movzx eax, word [ecx + 6]
imul esi, eax, 0x28
add esi, edx
cmp edx, esi
je 0x40dc9a
mov ecx, dword [ebp + 0xc]
cmp ecx, dword [edx + 0xc]
jb 0x40dc93
mov eax, dword [edx + 8]
add eax, dword [edx + 0xc]
cmp ecx, eax
jb 0x40dc9f
add edx, 0x28
cmp edx, esi
jne 0x40dc84
xor eax, eax
pop esi
pop ebp
ret
mov eax, edx
jmp 0x40dc9c
Function at 0x68564f
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0xf067223c
jmp 0x68568c
mov byte [esp + 4], bh
lea esp, [esp + 2]
mov dword [esp + 8], ebp
push edx
jmp 0x68565c
lea esp, [esp + 2]
mov dword [esp + 8], esp
push cx
push esp
jmp 0x685639
lea esp, [esp + 1]
push bp
pop word [esp]
lea esp, [esp + 3]
mov dword [esp + 4], esi
push dx
jmp 0x6856a2
mov bh, ch
bt ebx, eax
jmp 0x6856fc
lea esp, [esp + 2]
mov dword [esp], edi
pushfd
jmp 0x684d61
mov eax, esp
mov bp, 0x8a24
jmp 0x6856e6
rdtsc
push esp
jmp 0x68571c
mov esi, dword [esp + 0x2c]
mov dx, ax
bt ax, ax
jmp 0x68576d
jg 0x6856af
mov eax, esp
mov bp, 0x8a24
jmp 0x6856b5
mov edi, esp
rdtsc
bswap edx
mov ah, ch
lea ebp, [esp + 4]
lea eax, [ebx - 0xd7]
setge al
sub esp, 0xbc
jmp 0x685706
jne 0x6856b7
rdtsc
push esp
jmp 0x6856ba

Function at 0x690734
Capabilities:
Encode data using base64

Disassembly:
cmp ecx, 0x3e
jmp 0x6a8693
cmp ecx, 0x34
jmp 0x6a8501
call fcn.006a85d1
push esi
mov esi, 0xba11fdf8
push esi
xchg byte [esp + ebx*4 - 0x51335e38], dh
mov ecx, 0x4f888d98
add eax, ebp
invalid
jmp 0x691888
jmp 0x673508
jmp 0x6735f9
movzx eax, byte [ecx]
neg dl
mov dh, byte [esp]
jmp 0x6a83f8
shl eax, 8
clc
jmp 0x6a8428
movzx edx, byte [ecx + 1]
pushal
pop dword [esp + 1]
movzx ecx, byte [ecx + 2]
jmp 0x6a83e2
push ebx
xchg bx, dx
lea ebx, [ebx + esi]
mov dh, byte [esp]
push esi
jmp 0x6a847a
or eax, edx
mov dl, bh
lea edx, reloc.iphlpapi.dll_GetAdaptersInfo
lea esp, [esp + 0x1c]
jmp 0x6a8407
mov bh, 0xce
jmp 0x6a845a
pop bx
mov dx, 0x5e14
or eax, ecx
mov ecx, eax
jmp 0x6a8438
push 0x3f
xor esi, 0xf17722d0
pop ebx
rcr si, cl
jmp 0x6a8488
not esi
neg bx
shl eax, 8
and dl, cl
push cx
jmp 0x6a844e
mov edx, dword [esp]
inc dh
mov edx, eax
btc si, dx
jmp 0x6a84f4
push edi
shr esi, 6
stc
and ecx, ebx
jmp 0x6a84c9
lea esp, [esp + 0x18]
cmp ecx, 0x1a
jmp 0x6a84d1
and edx, ebx
and esi, ebx
and eax, ebx
jmp 0x6a84b3
jae 0x6734a4
lea ebx, [ecx + 0x41]
jmp 0x673484
mov esi, eax
sub esp, 0x14
shr ecx, 0x12
shr edx, 0xc
jmp 0x6a8495
jae 0x67346e
lea ebx, [ecx + 0x47]
jmp 0x673484
jae 0x6734d4
mov ebx, edi
lea ebx, [ecx - 4]
jmp 0x673484

Function at 0x690b8b
Capabilities:
Check for vm using instruction vpcext

Disassembly:
call fcn.00690b70
jmp 0x690bc1
mov dx, ax
lea edx, [esi + ebp]
mov dh, ah
lea esp, [esp + 2]
push eax
lea eax, [eax*4]
jmp 0x690bf1
mov dword [esp], edx
lea edx, reloc.iphlpapi.dll_GetAdaptersInfo
mov dx, word [esp]
not edx
push sp
lea edx, [ecx*4]
jmp 0x690ba6
mov eax, 0x4c956630
xchg edx, eax
pushal
pushal
call fcn.00690bdb

Function at 0x690bdb
Capabilities:
Check for vm using instruction vpcext

Disassembly:
lea esp, [esp + 0x44]
mov ax, si
jmp 0x690bff
mov al, 0x9e
pop eax
mov dh, 0xdc
mov dx, word [esp]
pop edx
call fcn.00690cbb
test dword [eax], ecx
sahf
stc
or dh, cl
xor eax, 0xaf5c35a5
insb byte es:[edi], dx
push esp
invalid
Function at 0x6c77c1
Capabilities:
Execute anti-debugging instructions

Disassembly:
setle cl
jmp 0x6c77c6
xchg cx, bx
jmp 0x6c77ab
lea esp, [esp + 4]
dec al
lea ebx, [eax*4]
sub esp, 0x16
jg 0x6c77f5
push dword [esp + 8]
mov bl, 0x22
jmp 0x6c77f7
jmp 0x6c7833
xchg word [esp + 0x14], cx
lea esp, [esp + 2]
jmp 0x6c7842
lea ecx, [ebx*4]
ror ebx, cl
je 0x6c786f
not bx
jmp 0x6c787b
push dword [esp + 8]
mov bl, 0x22
xchg word [esp + 0x14], cx
lea esp, [esp + 2]
lea esp, [esp + 0x18]
xor al, 0x61
jmp 0x6c7802
not bx
mov bl, 0x39
jmp 0x6c7a89
mov bl, 0x39
bswap ebx
jmp 0x6c7a8b
jmp 0x6c78f7
lea esp, [esp + 2]
jmp 0x6c7959
js 0x6c794d
pop cx
lea ecx, reloc.iphlpapi.dll_GetAdaptersInfo
jmp 0x6c78b6
sub esp, 0x10
lea ecx, [ebx + ebx]
call fcn.006c7906
stosd dword es:[edi], eax
dec ebp
popal
invalid
sub ebx, 0x923b6996
mov word [esi], ax
not bx
clc
jmp 0x6c7920
jge 0x6c78de
sub esp, 0x10
lea ecx, [ebx + ebx]
jmp fcn.00696e1c
pop cx
lea ecx, reloc.iphlpapi.dll_GetAdaptersInfo
lea esp, [esp + 2]
cbw
pushal
push dword [esp + 3]
jbe 0x6c78a0
sub ebx, 0x923b6996
jmp 0x6c78fd
bswap ebx
sub al, 0x83
pushfd
inc ecx
jmp 0x6c78d2
Function at 0x8a62fe
Capabilities:
Execute anti-debugging instructions

Disassembly:
cld
xchg word [esp + 0x18], ax
add esp, 0x2d
neg esi
inc edx
jmp 0x8a6334
bsr eax, esp
pop dword [esp]
setge ah
pop edx
mov dx, 0x6b48
setae dh
jmp 0x8a631e

Function at 0x8a66f1
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dx, 0x9494
setnp ah
std
bswap edx
lea edx, [edx + ebp]
bswap esi
jmp 0x8a65eb
bts si, dx
lea eax, reloc.iphlpapi.dll_GetAdaptersInfo
mov dx, 0x6fd5
rcl ah, 5
mov al, byte [esp]
bsf dx, bx
jmp 0x8a6582
neg ah
bswap edx
mov dx, word [esp]
xchg dx, ax
bsf ax, di
inc ah
jmp 0x8a6598
mov dword [esp], edx
setge dl
not al
rdtsc
xchg dl, dh
pop esi
jmp 0x8a65fe
bts eax, eax
neg esi
mov esi, dword [esp]
sub ax, 0xd7a1
push eax
mov eax, dword [esp + 3]
jmp 0x8a65d5
sub esp, 0x1a
bsf esi, ecx
lea edx, [ebx + edi]
add esp, 0x10
xchg byte [esp + 8], ah
pushfd
jmp 0x8a6698
stc
xchg word [esp], dx
cmc
rdtsc
pop si
neg esi
jmp 0x8a65c2
pop si
call fcn.008a6663
rdtsc
push word [esp + 0xd]
mov al, byte [esp + 2]
pop word [esp + 0xb]
jmp 0x8a66cb
neg al
mov word [esp + 2], ax
not si
xchg byte [esp], dh
mov al, 0x31
bswap edx
jmp 0x8a6712
pop ax
jmp 0x8a6616
pushal
cld
bswap eax
mov ah, byte [esp + 0x1a]
mov ax, 0xcb6
call fcn.008a67ff
xchg ecx, eax
pop ss
xchg edx, esp
adc esi, edi
or ah, byte [ebp + 0x244c88d4]
or cl, byte [ebp + 0x9d34]
add byte [eax], al
mov byte [esp + 0xa], cl
lea esi, [ebx*4]
and eax, esi
mov al, byte [esp + 6]
mov eax, dword [esp + 2]
mov eax, dword [esp + 6]
jmp 0x8a66f8

Function at 0x8a683e
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov byte [esp + 1], ch
xchg dword [esp], edx
bswap edx
mov word [esp + 2], di
jmp 0x8a685c

Function at 0x8a6bd5
Capabilities:
Execute anti-debugging instructions

Disassembly:
pop word [esp]
xchg esi, eax
jmp 0x8a6c17
push word [esp + 1]
xchg dh, al
mov byte [esp + 1], ch
setl dh
mov ah, 2
jmp 0x8a6c01

Function at 0x8a6ffe
Capabilities:
Access peb ldr_data

Disassembly:
jmp 0x8a2018
call fcn.008a201d
call 0x8a606e
jmp 0x8a7081
mov word [esp + 1], cx
mov dword [esp], edx
push word [esp + 1]
jmp 0x8a705a
mov dword [esp + 8], edi
lea esp, [esp + 8]
jmp 0x8a70b7
lea esp, [esp + 2]
mov dword [esp + 0xc], esi
push di
lea esp, [esp + 2]
jmp 0x8a7044
pop eax
jmp 0x8a70db
mov eax, dword [eax]
mov eax, dword [eax + 8]
push eax
jmp 0x8a6069
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x1c]
jmp 0x8a7097
sub eax, 0x4a606e
push eax
jmp 0x8a1fcb
Function at 0x403cf0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
and esp, 0xffffffc0
sub esp, 0x434
cmp dword [0x5e8438], 0x400
push ebx
push esi
push edi
jne 0x403da4
push 0
push 0
lea eax, [esp + 0x48]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasA]
push 0
call fcn.00403fa9
add esp, 4
push 0
push 0
call fcn.004044a6
push 0
push 0
call fcn.00403fe3
push 0
push 0
call fcn.00404256
push 0
call fcn.004046c6
add esp, 0x1c
push 0
push 0
push 0
call fcn.004045dd
fldz
push ecx
fst qword [esp + 8]
fstp qword [esp]
call fcn.00403e40
add esp, 8
fstp st(0)
mov eax, esp
mov dword [eax], 0
mov dword [eax + 4], 0
call fcn.00403e80
fstp st(0)
mov eax, esp
mov dword [eax], 0
mov dword [eax + 4], 0
call fcn.00404130
fstp st(0)
push 0
call fcn.0040473a
add esp, 0xc
mov edi, dword [sym.imp.KERNEL32.dll_SetFilePointer]
xor esi, esi
lea esp, [esp]
push 0
push 0
push 0
push 0
call edi
cmp esi, 0x4f4d1f2
jg 0x403dcb
inc esi
cmp esi, 0x33b4f19
jl 0x403db0
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
xor esi, esi
lea esp, [esp]
call edi
call ebx
cmp esi, 0x12e8236
jg 0x403df5
inc esi
cmp esi, 0x2ff8b
jl 0x403de0
mov ecx, dword [0x444c5c]
mov dword [0x5e8438], ecx
call fcn.004039f0
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov edi, 0x2ec37
cmp dword [0x5e8438], 0x51f
jne 0x403e26
lea edx, [esp + 0x40]
push edx
push 0
call esi
dec edi
jne 0x403e11
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0x10

Function at 0x4093bf
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x441420]
jne 0x4093c9
repz ret
jmp fcn.0040dfbf
Function at 0x40d5c0
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x441420]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00407abd
and dword [ebp - 0x14], 0
cmp dword [0x4593c8], 0
mov dword [ebp - 0x18], eax
jne 0x40d673
push 0x4034fc
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x40d71b
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x4034f0
push ebx
call edi
test eax, eax
je 0x40d71b
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push 0x4034e0
push ebx
mov dword [0x4593c8], eax
call edi
push eax
call esi
push 0x4034cc
push ebx
mov dword [0x4593cc], eax
call edi
push eax
call esi
push 0x4034b0
push ebx
mov dword [0x4593d0], eax
call edi
push eax
call esi
mov dword [0x4593d8], eax
test eax, eax
je 0x40d673
push 0x403498
push ebx
call edi
push eax
call esi
mov dword [0x4593d4], eax
mov eax, dword [0x4593d4]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x40d6cc
cmp dword [0x4593d8], ecx
je 0x40d6cc
push eax
call esi
push dword [0x4593d8]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x40d6cc
test ebx, ebx
je 0x40d6cc
call edi
test eax, eax
je 0x40d6c3
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x40d6c3
test byte [ebp - 8], 1
jne 0x40d6cc
or dword [ebp + 0x10], 0x200000
jmp 0x40d6ff
mov eax, dword [0x4593cc]
cmp eax, dword [ebp - 0x18]
je 0x40d6ff
push eax
call esi
test eax, eax
je 0x40d6ff
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x40d6ff
mov eax, dword [0x4593d0]
cmp eax, dword [ebp - 0x18]
je 0x40d6ff
push eax
call esi
test eax, eax
je 0x40d6ff
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x4593c8]
call esi
test eax, eax
je 0x40d71b
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x40d71d
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004093bf
leave
ret
Function at 0x401f10
Capabilities:
Get disk information
Inspect load icon resource
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x148
push ebx
push esi
push edi
push 0x65
push eax
call dword [sym.imp.USER32.dll_LoadIconA]
lea ecx, [esp + 0xc]
call fcn.00401000
lea ecx, [esp + 0x50]
push 0x104
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edx, [esp + 0x50]
lea ecx, [esp + 0xc]
push edx
call fcn.004012b0
test eax, eax
je 0x402021
lea eax, [esp + 0x50]
push 0x404030
push eax
call dword [sym.imp.MSVCRT.dll_fopen]
mov esi, eax
add esp, 8
test esi, esi
je 0x402084
lea ecx, [esp + 0x50]
push ecx
lea ecx, [esp + 0x10]
call fcn.00401290
mov edi, dword [sym.imp.MSVCRT.dll_fseek]
sub eax, 8
push 0
push eax
push esi
call edi
mov ebx, dword [sym.imp.MSVCRT.dll_fread]
push esi
push 1
lea edx, [esp + 0x24]
push 8
push edx
call ebx
mov eax, dword [esp + 0x2c]
push 0
push eax
push esi
call edi
push esi
push 1
lea ecx, [esp + 0x48]
push 0x38
push ecx
call ebx
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
mov eax, dword [esp + 0x88]
mov edx, dword [esp + 0x50]
add esp, 0x3c
test eax, eax
mov eax, dword [esp + 0x10]
push edx
push eax
jne 0x401ffe
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401800
jmp 0x402084
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401a90
jmp 0x402084
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString_1
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov edi, eax
mov esi, 1
xor ebx, ebx
test edi, esi
je 0x40206a
mov dl, bl
lea ecx, [esp + 0x10]
add dl, 0x41
push edx
call sub.MFC42.DLL_CString::operator_1
push 0x40412c
lea ecx, [esp + 0x14]
call fcn.004020e2
lea ecx, [esp + 0xc]
mov eax, dword [esp + 0x10]
push eax
push 0
call fcn.00401cf0
add esi, esi
inc ebx
cmp ebx, 0x1a
jl 0x402039
lea ecx, [esp + 0xc]
call fcn.00401040
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0xc]
call fcn.00401030
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x148
ret 0x10

Function at 0x432006
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
call 0x43200c
nop
nop
nop
nop
nop
pop eax
nop
add eax, 0x40729f
sub eax, 0x407245
nop
nop
nop
nop
nop
mov ebx, dword [eax]
nop
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
jl 0x432030
nop
nop
nop
nop
nop
add eax, 0xc
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x43201e
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x431219
Function at 0x433002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
call 0x43300c
nop
pop eax
nop
nop
nop
nop
add eax, 0x40a063
nop
sub eax, 0x40a009
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x433030
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
jne 0x43301e
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp fcn.00431219
Function at 0xec0188
Capabilities:
Encode data using xor

Disassembly:
jmp 0xec0192
pushal
call 0xec0198
pop ebp
sub ebp, 0x10
sub ebp, 0xac0188
jmp 0xec01ae
mov eax, 0xac0188
add eax, ebp
add eax, 0x4c
mov ecx, 0x5ba
mov edx, 0x170c332a
xor byte [eax], dl
inc eax
dec ecx
jne 0xec01c5
jmp 0xec01d8
mov eax, dword [0x16a3a1e7]
sub ch, byte [edx]
sub ch, byte [ebx + 0x2a2ad2eb]
sub ch, byte [ecx]
out 0x92, eax
and ebp, dword [edx]
sub ch, byte [edx]
nop
add ch, byte [edx]
sub ch, byte [edx]
invalid
Function at 0x724c60
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x20d000]
push edi
or ebp, 0xffffffff
jmp 0x724c82
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x724c89
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x724c78
mov eax, 1
add ebx, ebx
jne 0x724c9b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x724cac
jne 0x724ccb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x724ccb
dec eax
add ebx, ebx
jne 0x724cb8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x724c90
add ebx, ebx
jne 0x724cc7
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x724d1d
xor ecx, ecx
sub eax, 3
jb 0x724ce3
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x724d52
sar eax, 1
mov ebp, eax
jmp 0x724cee
add ebx, ebx
jne 0x724cee
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x724cbc
inc ecx
add ebx, ebx
jne 0x724cfc
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x724cbc
add ebx, ebx
jne 0x724d09
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x724cfe
jne 0x724d1a
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x724cfe
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x724d3c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x724d2e
jmp 0x724c7e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x724d3c
add edi, ecx
jmp 0x724c7e
pop esi
mov edi, esi
mov ecx, 0x68e9
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x724d5a
cmp byte [edi], 0xe
jne 0x724d5a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x724d5f
lea edi, [esi + 0x31b000]
mov eax, dword [edi]
or eax, eax
je 0x724dd7
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x328b64]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x328ca4]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x724d8c
mov ecx, edi
jns 0x724dbb
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x328ca8]
or eax, eax
je 0x724dd1
mov dword [ebx], eax
add ebx, 4
jmp 0x724da9
call dword [esi + 0x328cb8]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x724e08
cmp al, 0xef
ja 0x724dfb
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x724ddd
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x724dea
mov ebp, dword [esi + 0x328cac]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x21f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x724e3c
sub esp, 0xffffff80
jmp 0x4abad3
Function at 0x10017ec0
Capabilities:
Packed with generic packer

Disassembly:
cmp byte [esp + 8], 1
jne 0x10018084
pushal
mov esi, section.UPX1
lea edi, [esi - 0x8000]
push edi
or ebp, 0xffffffff
jmp 0x10017eea
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x10017ef1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x10017ee0
mov eax, 1
add ebx, ebx
jne 0x10017f03
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x10017ef8
jne 0x10017f14
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x10017ef8
xor ecx, ecx
sub eax, 3
jb 0x10017f28
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x10017f9a
mov ebp, eax
add ebx, ebx
jne 0x10017f33
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x10017f40
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x10017f64
inc ecx
add ebx, ebx
jne 0x10017f50
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x10017f45
jne 0x10017f61
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x10017f45
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x10017f84
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x10017f75
jmp 0x10017ee6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x10017f84
add edi, ecx
jmp 0x10017ee6
pop esi
mov edi, esi
mov ecx, 0x94
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x10017fa2
cmp byte [edi], 7
jne 0x10017fa2
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x10017fa7
lea edi, [esi + 0x15000]
mov eax, dword [edi]
or eax, eax
je 0x10018016
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x184f0]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x18594]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x10017fd4
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x18598]
or eax, eax
je 0x10018010
mov dword [ebx], eax
add ebx, 4
jmp 0x10017ff1
popal
xor eax, eax
ret 0xc
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x10018047
cmp al, 0xef
ja 0x1001803a
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x1001801c
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x10018029
mov ebp, dword [esi + 0x1859c]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x22f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x1001807b
sub esp, 0xffffff80
jmp 0x10003035