joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10009417
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
pushal
call 0x10009426
pop dword [ebp - 0xc]
mov eax, 0xeaad0a19
add eax, 0x25538a0d
sub dword [ebp - 0xc], eax
mov dword [ebp - 0x1c], 0x6e2a9a2b
add dword [ebp - 0x1c], 0xe027ab20
mov dword [ebp - 0x18], 0x20cf7adf
add dword [ebp - 0x18], 0x1163d166
mov dword [ebp - 0x14], 0x1052a5b0
sub dword [ebp - 0x14], 0xc4066182
mov dword [ebp - 0x10], 0x1d626921
sub dword [ebp - 0x10], 0x1d626921
lea eax, [ebp - 0x1c]
push eax
mov eax, 0xee30e767
sub eax, 0xde3036d3
add eax, dword [ebp - 0xc]
call dword [eax]
mov dword [ebp - 0x1c], 0xb2bc74b5
sub dword [ebp - 0x1c], 0x3e4a0b5f
mov dword [ebp - 0x18], 0x6be880e8
add dword [ebp - 0x18], 0xd583e08d
mov dword [ebp - 0x14], 0xfbb1fbe9
sub dword [ebp - 0x14], 0x98428f7d
mov dword [ebp - 0x10], 0xde418202
sub dword [ebp - 0x10], 0xde418202
lea ebx, [ebp - 0x1c]
push ebx
push eax
mov eax, 0x70e14045
add eax, 0x9f1f7007
add eax, dword [ebp - 0xc]
call dword [eax]
push 0x40
push 0x1000
push 0x3898e
push 0
call eax
mov ecx, 0xd6b38e59
add ecx, 0x294cbe30
xor edi, edi
add edi, eax
mov esi, 0x55d8aea0
sub esi, 0x45d75ea0
add esi, dword [ebp - 0xc]
mov ebx, 0xfe5ded31
mov dword [ebp - 4], 0xb56283b3
mov edx, dword [esi]
xor dword [ebp - 8], 0x291f77b3
xor edx, ebx
xor dword [ebp - 4], edi
mov dword [edi], edx
add dword [ebp - 8], esi
add edi, 0xb58f44cf
add edi, 0x4a70bb35
add esi, 4
loop 0x10009544
add eax, 0x124f7
mov ebx, eax
add eax, 0x5eb41af9
sub eax, 0x5eb41af4
mov ecx, 0x10000000
add ecx, dword [ebp - 0xc]
call ebx
leave
ret

Function at 0x403910
Capabilities:
Accept command line arguments
Hide graphical window

Disassembly:
mov ecx, ebp
push ebp
mov ebp, esp
add ecx, 4
mov dword [0x4040fe], ecx
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov dword [0x404670], eax
push 0
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
mov dword [0x404604], eax
mov dword [0x4040f6], eax
mov dword [0x4045f0], 0x30
mov dword [0x4045f4], 2
jmp 0x403955
mov dword [0x4045f8], 0x402f69
mov dword [0x4045fc], 0
mov dword [0x404600], 0
mov dword [0x404618], 0x404564
mov dword [0x404610], 0xf
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadIconA]
mov dword [0x404608], eax
mov dword [0x40461c], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadCursorA]
mov dword [0x40460c], eax
push 0x4045f0
call dword [sym.imp.user32.dll_RegisterClassExA]
push 0
push dword [0x4040f6]
push 0
push 0
push 0x1e5
push 0x203
push 0xfffff98e
push 0xfffff9c0
push 0xcf0000
push str.asdlkjalsdj_ai8
push str.first
push 0
call dword [sym.imp.user32.dll_CreateWindowExA]
mov dword [0x404668], eax
push 5
push dword [0x404668]
call dword [sym.imp.user32.dll_ShowWindow]
push dword [0x404668]
call dword [sym.imp.user32.dll_UpdateWindow]
xor edi, edi
lea ebx, [0x404620]
jmp 0x403a29
push ebx
call dword [sym.imp.user32.dll_TranslateMessage]
push ebx
call dword [sym.imp.user32.dll_DispatchMessageA]
push edi
push edi
push edi
push ebx
call dword [sym.imp.user32.dll_GetMessageA]
test al, al
jne 0x403a1b
mov eax, dword [0x404628]
jmp 0x403a44
call 0x402a90
ret
Function at 0x401f90
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x80
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
mov dword [esp + 0x74], 0
mov dword [esp + 0x70], 0x2071
mov dword [esp + 0x68], 0x2c0a
mov dword [esp + 0x4c], 0
mov dword [esp + 0x48], 0x1a43
mov edx, dword [esp + 0x78]
imul esi, edx, 0x407f
xor edi, edi
mov ebx, 0x1a43
mov dword [esp + 0x78], esi
mov dword [esp + 0x38], eax
mov dword [esp + 0x60], ecx
mov dword [esp + 0x58], ecx
mov eax, dword [esp + 0x38]
mov ecx, esp
mov dword [ecx], eax
mov dword [esp + 0x30], edi
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x28], edx
call fcn.00402b00
sub esp, 4
mov dword [esp + 0x54], eax
mov ecx, eax
add ecx, 0x18
movzx eax, word [eax + 0x14]
mov si, ax
mov eax, dword [esp + 0x70]
mov edx, dword [esp + 0x74]
xor eax, 0x505e
mov edi, 0x1a42
sub edi, eax
mov eax, dword [esp + 0x30]
sbb eax, edx
mov dword [esp + 0x24], ecx
mov word [esp + 0x22], si
mov dword [esp + 0x1c], eax
mov dword [esp + 0x18], edi
jb 0x4020d5
jmp 0x40204d
mov eax, dword [esp + 0x64]
mov ecx, dword [esp + 0x68]
xor ecx, 0x2c0b
add eax, ecx
mov dword [esp + 0x64], eax
mov eax, dword [esp + 0x5c]
add eax, 0x28
mov dword [esp + 0x5c], eax
jmp 0x40214e
mov eax, dword [esp + 0x50]
mov ecx, dword [esp + 0x40]
mov ecx, dword [ecx + 0x14]
mov edx, dword [esp + 0x34]
add ecx, dword [esp + 0x3c]
mov esi, esp
mov dword [esi + 8], edx
mov dword [esi + 4], ecx
mov dword [esi], eax
call fcn.00403600
sub esp, 0xc
mov dword [esp + 0x14], eax
jmp 0x40204d
mov eax, dword [esp + 0x54]
mov cl, byte [esp + 0x6f]
add cl, cl
mov eax, dword [eax + 0x54]
mov byte [esp + 0x6f], cl
mov edx, dword [esp + 0x38]
mov esi, dword [esp + 0x58]
mov edi, esp
mov dword [edi + 8], eax
mov dword [edi + 4], edx
mov dword [edi], esi
call fcn.00403600
sub esp, 0xc
mov dword [esp + 0x10], eax
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 8
mov eax, 0x2c0a
mov cl, byte [esp + 0x6f]
or cl, 0x41
mov edx, dword [esp + 0x68]
mov byte [esp + 0x6f], cl
mov si, word [esp + 0x22]
movzx edi, si
mov ebx, dword [esp + 0x24]
add ebx, edi
sub eax, edx
mov dword [esp + 0x5c], ebx
mov dword [esp + 0x64], eax
jmp 0x40214e
mov eax, dword [esp + 0x5c]
mov eax, dword [eax + 0xc]
mov ecx, dword [esp + 0x58]
mov byte [esp + 0x47], 0xa0
add ecx, eax
mov dl, byte [esp + 0x47]
mov dword [esp + 0x50], ecx
mov dh, byte [esp + 0x6f]
mov eax, dword [esp + 0x5c]
mov byte [esp + 0x6f], dh
mov eax, dword [eax + 0x10]
mov dword [esp + 0x34], eax
mov eax, dword [esp + 0x38]
mov dword [esp + 0x3c], eax
mov eax, dword [esp + 0x5c]
mov dword [esp + 0x40], eax
cmp dl, 0xb1
jne 0x402071
jmp 0x402071
mov eax, dword [esp + 0x64]
mov ecx, dword [esp + 0x54]
movzx ecx, word [ecx + 6]
mov edx, dword [esp + 0x28]
and edx, 0x7f98
mov dword [esp + 0x78], edx
cmp eax, ecx
jb 0x402103
jmp 0x40209c
Function at 0x402200
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0xa0
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
mov edx, 0xa4f2
mov word [esp + 0x8e], 0x1dad
mov dword [esp + 0x84], 0
mov dword [esp + 0x80], 0x1801
mov dword [esp + 0x7c], 0x2ec5
sub edx, dword [esp + 0x7c]
mov dword [esp + 0x3c], edx
mov edx, dword [esp + 0x7c]
mov esi, dword [esp + 0x3c]
xor edx, 0x4e88
cmp esi, edx
mov dword [esp + 0x28], eax
mov dword [esp + 0x24], ecx
jae 0x4023a9
jmp 0x40228c
mov eax, 0x10af
mov ecx, dword [esp + 0x7c]
add ecx, 0x4174
mov dword [esp + 0x64], ecx
cmp eax, dword [esp + 0x64]
ja 0x402382
jmp 0x40233f
mov eax, 0x2edd
sub eax, dword [esp + 0x7c]
cmp dword [esp + 0x34], eax
jb 0x402358
mov eax, esp
lea ecx, [esp + 0x43]
mov dword [eax], ecx
call fcn.00402420
sub esp, 4
mov dword [esp + 0x88], 0x7ec2
movzx ecx, word [esp + 0x8e]
add ecx, 0xffffe253
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x78], eax
mov edx, esp
mov dword [edx], eax
mov dword [esp + 0x20], ecx
call fcn.00403530
sub esp, 4
mov si, ax
mov word [esp + 0x74], si
mov word [esp + 0x76], si
mov dword [esp + 0x60], 0
mov eax, dword [esp + 0x5c]
mov ecx, dword [esp + 0x30]
mov edx, esp
lea edi, [esp + 0x60]
mov dword [edx + 0xc], edi
mov edi, dword [esp + 0x20]
mov si, di
movzx ebx, si
mov dword [edx + 8], ebx
lea ebx, [esp + 0x74]
mov dword [edx + 4], ebx
mov dword [edx], eax
call ecx
sub esp, 0x10
mov byte [esp + 0x9b], 2
mov dword [esp + 0x38], eax
mov eax, dword [esp + 0x60]
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 8
mov eax, dword [esp + 0x34]
mov ecx, dword [esp + 0x7c]
add ecx, 0xffffd13c
add eax, ecx
mov dword [esp + 0x34], eax
jmp 0x40228c
mov eax, dword [esp + 0x68]
mov ecx, dword [esp + 0x6c]
mov edx, dword [esp + 0x80]
mov esi, dword [esp + 0x84]
xor edx, eax
xor ecx, esi
xor edx, 0x2f82
or edx, ecx
mov dword [esp + 0x1c], edx
je 0x402358
jmp 0x402382
mov eax, dword [esp + 0x34]
mov cl, byte [esp + eax + 0x43]
mov eax, dword [esp + 0x7c]
xor eax, 0x2e6b
mov edx, dword [esp + 0x34]
movsx esi, cl
xor esi, eax
mov eax, esi
mov cl, al
mov byte [esp + edx + 0x43], cl
jmp 0x40226a
lea eax, [0x4060e0]
mov ecx, 0x19
lea edx, [esp + 0x43]
mov esi, dword [esp + 0x80]
mov edi, dword [esp + 0x84]
xor esi, 0x7438
mov dword [esp + 0x6c], edi
mov dword [esp + 0x68], esi
mov esi, dword [esp + 0x28]
mov dword [esp + 0x2c], esi
mov edi, dword [esp + 0x24]
mov dword [esp + 0x5c], edi
mov ebx, dword [esp + 0x7c]
xor ebx, 0x2ec5
mov dword [esp], edx
mov dword [esp + 4], eax
mov dword [esp + 8], 0x19
mov dword [esp + 0x18], ecx
mov dword [esp + 0x14], ebx
call sub.msvcrt.dll_memcpy
mov eax, dword [esp + 0x14]
mov dword [esp + 0x34], eax
jmp 0x40228c
Function at 0x405000
Capabilities:
Get memory capacity

Disassembly:
mov dword [0x41f9a0], esi
push ebp
push esp
mov dword [0x41f9a4], edi
pop dword [0x41f9b0]
mov dword [0x41f9a8], ebx
pop dword [0x41f9ac]
mov dword [0x41f9a0], esi
jmp fcn.00401530
Function at 0x4035ac
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x613008], 0x8088405
inc edx
mov dword [ebx + 0x613008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x41cf44
Capabilities:
Decompress data using aplib

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push ebp
mov esi, dword [ebp - 4]
mov edi, dword [ebp - 8]
cld
mov dl, 0x80
mov al, byte [esi]
add esi, 1
mov byte [edi], al
add edi, 1
mov ebx, 2
add dl, dl
jne 0x41cf75
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x41cf5d
add dl, dl
jne 0x41cf80
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x41cfd1
xor eax, eax
add dl, dl
jne 0x41cf8d
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x41d06e
add dl, dl
jne 0x41cf9c
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41cfa7
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41cfb2
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41cfbd
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x41cfc7
mov ebx, edi
sub ebx, eax
mov al, byte [ebx]
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x41cf6c
mov eax, 1
add dl, dl
jne 0x41cfdf
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41cfea
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x41cfd6
sub eax, ebx
mov ebx, 1
jne 0x41d01d
mov ecx, 1
add dl, dl
jne 0x41d003
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x41d00e
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x41cffa
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x41cf6c
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x41d034
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x41d03f
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x41d02b
cmp eax, 0x7d00
sbb ecx, 0xffffffff
cmp eax, 0x500
sbb ecx, 0xffffffff
cmp eax, 0x80
adc ecx, 0
cmp eax, 0x80
adc ecx, 0
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x41cf6c
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x41d08f
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x41cf6c
pop ebp
sub edi, dword [ebp - 8]
mov dword [ebp - 0xc], edi
pop edi
pop esi
pop ebx
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret
Function at 0x41f0a0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov ebx, edx
xor edx, edx
push ebp
push 0x5f758e
push dword fs:[edx]
mov dword fs:[edx], esp
xor edx, edx
mov dword [ebp - 8], edx
mov esi, ebx
xor ecx, ecx
cmp byte [eax + 0x6a], 0
je 0x41f0ef
mov eax, ebx
xor edx, edx
push edx
push eax
mov eax, dword [esi + 0x3c]
cdq
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
mov edx, dword [eax + 0x88]
test edx, edx
je 0x41f10e
mov ecx, edx
add ecx, ebx
jmp 0x41f10e
mov eax, ebx
xor edx, edx
push edx
push eax
mov eax, dword [esi + 0x3c]
cdq
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
mov edx, dword [eax + 0x78]
test edx, edx
je 0x41f10e
mov ecx, edx
add ecx, ebx
test ecx, ecx
je 0x41f180
mov esi, dword [ecx + 0x18]
mov eax, dword [ecx + 0x1c]
add eax, ebx
mov dword [ebp - 0x10], eax
mov edi, dword [ecx + 0x20]
add edi, ebx
mov eax, dword [ecx + 0x24]
add eax, ebx
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
cmp eax, 0xffff
jbe 0x41f169
test esi, esi
jbe 0x41f180
mov eax, dword [edi]
add eax, ebx
mov edx, dword [ebp - 4]
call fcn.004088ec
test eax, eax
jne 0x41f15b
mov eax, dword [ebp - 0xc]
movzx eax, word [eax]
shl eax, 2
add eax, dword [ebp - 0x10]
mov eax, dword [eax]
mov dword [ebp - 8], eax
jmp 0x41f180
add dword [ebp - 0xc], 2
add edi, 4
dec esi
test esi, esi
ja 0x41f138
jmp 0x41f180
mov edx, eax
sub edx, dword [ecx + 0x10]
cmp edx, dword [ecx + 0x14]
jae 0x41f180
mov eax, edx
shl eax, 2
add eax, dword [ebp - 0x10]
mov eax, dword [eax]
mov dword [ebp - 8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5f7595
ret
Function at 0x4202d8
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov word [ebp - 4], cx
mov byte [ebp - 1], dl
xor eax, eax
push ebp
push 0x5f88f3
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
call fcn.00404cd0
xor ebx, ebx
mov eax, ebx
and eax, 0x80000001
jns 0x420313
dec eax
or eax, 0xfffffffe
inc eax
test eax, eax
jne 0x42032c
lea eax, [ebp - 0x10]
mov edx, dword [0x61554c]
mov edx, dword [edx]
mov edx, dword [edx + 0xc]
call fcn.00404d30
jmp 0x42033f
lea eax, [ebp - 0x10]
mov edx, dword [0x61554c]
mov edx, dword [edx]
mov edx, dword [edx + 0x10]
call fcn.00404d30
lea eax, [ebp - 0x10]
mov edx, ebx
sar edx, 1
jns 0x42034b
adc edx, 0
mov edx, dword [edx*4 + 0x614378]
call fcn.00404f20
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
mov eax, dword [ebp - 0x10]
call fcn.00404f04
push eax
call fcn.00406b1c
mov esi, eax
cmp esi, 0xffffffff
je 0x4204c5
mov eax, 0x40
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 8]
push eax
push 0x40
push edi
push esi
call fcn.00406d7c
test eax, eax
je 0x4204b8
mov eax, edi
cmp word [eax], 0x5a4d
jne 0x4204b8
push 0
push 0
mov eax, dword [eax + 0x3c]
push eax
push esi
call fcn.00406ddc
mov eax, edi
call fcn.00403288
mov eax, 0x18
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 8]
push eax
push 0x18
push edi
push esi
call fcn.00406d7c
test eax, eax
je 0x4204b8
mov eax, edi
cmp dword [eax], 0x4550
jne 0x4204b8
add eax, 4
mov dword [ebp - 0xc], eax
cmp byte [ebp - 1], 0
je 0x420456
mov eax, dword [ebp - 0xc]
cmp word [eax], 0x8664
jne 0x420456
mov eax, edi
call fcn.00403288
mov eax, 0xf0
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 8]
push eax
push 0xf0
push edi
push esi
call fcn.00406d7c
test eax, eax
je 0x420456
mov eax, edi
mov dx, word [eax + 0x44]
cmp dx, word [ebp - 4]
jne 0x420456
mov eax, dword [eax + 0x10]
mov edx, dword [ebp + 0xc]
mov dword [edx], eax
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0x10]
call fcn.00404d0c
cmp byte [ebp - 1], 0
jne 0x4204b8
mov eax, dword [ebp - 0xc]
cmp word [eax], 0x14c
jb 0x4204b8
mov eax, dword [ebp - 0xc]
cmp word [eax], 0x150
ja 0x4204b8
mov eax, edi
call fcn.00403288
mov eax, 0xe0
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 8]
push eax
push 0xe0
push edi
push esi
call fcn.00406d7c
test eax, eax
je 0x4204b8
mov eax, edi
mov dx, word [eax + 0x44]
cmp dx, word [ebp - 4]
jne 0x4204b8
mov eax, dword [eax + 0x10]
mov edx, dword [ebp + 0xc]
mov dword [edx], eax
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0x10]
call fcn.00404d0c
mov eax, edi
call fcn.00403288
push esi
call fcn.00406ad4
mov eax, dword [ebp + 8]
mov eax, dword [eax]
xor edx, edx
call fcn.0040502c
jne 0x4204dd
inc ebx
cmp ebx, 0x19
jne 0x420305
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5f88fa
lea eax, [ebp - 0x10]
call fcn.00404cd0
ret
Function at 0x401b4b
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
pushal
call 0x401b5a
pop dword [ebp - 0x38]
mov eax, 0x401b5a
sub dword [ebp - 0x38], eax
mov dword [ebp - 0x48], 0xcd7d812
sub dword [ebp - 0x48], 0xbe8592c7
mov dword [ebp - 0x44], 0x56967dfa
add dword [ebp - 0x44], 0xdb9cce4b
mov dword [ebp - 0x40], 0xc56006dd
add dword [ebp - 0x40], 0x86ec3d51
mov dword [ebp - 0x3c], 0x20f2ec2c
add dword [ebp - 0x3c], 0xdf0d13d4
lea eax, [ebp - 0x48]
push eax
mov eax, sym.imp.kernel32.dll_LoadLibraryA
add eax, dword [ebp - 0x38]
call dword [eax]
mov dword [ebp - 0x48], 0x806ea5ac
add dword [ebp - 0x48], 0xf403c3aa
mov dword [ebp - 0x44], 0xfba42e5a
sub dword [ebp - 0x44], 0xba37cce5
mov dword [ebp - 0x40], 0x760d4b8e
add dword [ebp - 0x40], 0xed6220de
mov dword [ebp - 0x3c], 0x545679f4
add dword [ebp - 0x3c], 0xaba9860c
lea ebx, [ebp - 0x48]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x38]
call dword [eax]
push 0x40
push 0x1000
push 0x3d3b5
push 0
call eax
mov ecx, 0xa8c73902
add ecx, 0x57391d1d
mov edi, eax
mov edx, 0x5c7fe1cc
sub edx, 0x5c3e31cc
add edx, dword [ebp - 0x38]
mov esi, 0xc974ca00
xor dword [ebp - 0x28], 0x2bb6df36
mov ebx, dword [edx]
sub dword [ebp - 0xc], 0x24f3badd
sub ebx, esi
add dword [ebp - 4], eax
mov dword [edi], ebx
add dword [ebp - 0x28], edx
add edi, 4
add edx, 0x8bd8e05c
sub edx, 0x8bd8e058
loop 0x401c67
add eax, 0xd0da2ed1
sub eax, 0xd0d8e382
xor ebx, ebx
add ebx, eax
add eax, 0x5df1a0e2
add eax, 0xa20e5f23
mov ecx, 0x400000
add ecx, dword [ebp - 0x38]
call ebx
leave
ret

Function at 0x401ea2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x410284]
jne 0x401eac
repz ret
jmp fcn.00403e53
Function at 0x499ad0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x56000]
push edi
or ebp, 0xffffffff
jmp 0x499af2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x499af9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x499ae8
mov eax, 1
add ebx, ebx
jne 0x499b0b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x499b00
jne 0x499b1c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x499b00
xor ecx, ecx
sub eax, 3
jb 0x499b30
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x499ba2
mov ebp, eax
add ebx, ebx
jne 0x499b3b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x499b48
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x499b6c
inc ecx
add ebx, ebx
jne 0x499b58
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x499b4d
jne 0x499b69
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x499b4d
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x499b8c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x499b7d
jmp 0x499aee
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x499b8c
add edi, ecx
jmp 0x499aee
pop esi
mov edi, esi
mov ecx, 0x82
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x499baa
cmp byte [edi], 0xf
jne 0x499baa
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x499baf
lea edi, [esi + 0x97000]
mov eax, dword [edi]
or eax, eax
je 0x499c1e
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x994a0]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x994dc]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x499bdc
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x994e4]
or eax, eax
je 0x499c18
mov dword [ebx], eax
add ebx, 4
jmp 0x499bf9
call dword [esi + 0x994e0]
mov ebp, dword [esi + 0x994e8]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1ef]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x499c52
sub esp, 0xffffff80
jmp 0x401e20
Function at 0x501cf0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x502328
push 0x501ef0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
add esp, 0xffffff98
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov dword [ebp - 4], 0
push 2
call dword [sym.imp.MSVCRT.dll___set_app_type]
add esp, 4
mov dword [0x503424], 0xffffffff
mov dword [0x503428], 0xffffffff
call dword [sym.imp.MSVCRT.dll___p__fmode]
mov ecx, dword [0x503420]
mov dword [eax], ecx
call dword [sym.imp.MSVCRT.dll___p__commode]
mov edx, dword [0x50341c]
mov dword [eax], edx
mov eax, dword [sym.imp.MSVCRT.dll__adjust_fdiv]
mov ecx, dword [eax]
mov dword [0x50342c], ecx
call fcn.00501ee0
mov eax, dword [0x503154]
test eax, eax
jne 0x501d81
push 0x501ed0
call dword [sym.imp.MSVCRT.dll___setusermatherr]
add esp, 4
call fcn.00501eb0
push 0x50300c
push 0x503008
call sub.MSVCRT.dll__initterm
add esp, 8
mov edx, dword [0x503418]
mov dword [ebp - 0x6c], edx
lea eax, [ebp - 0x6c]
push eax
mov ecx, dword [0x503414]
push ecx
lea edx, [ebp - 0x64]
push edx
lea eax, [ebp - 0x70]
push eax
lea ecx, [ebp - 0x60]
push ecx
call dword [sym.imp.MSVCRT.dll___getmainargs]
add esp, 0x14
push 0x503004
push section..data
call sub.MSVCRT.dll__initterm
add esp, 8
call dword [sym.imp.MSVCRT.dll___p__acmdln]
mov esi, dword [eax]
mov dword [ebp - 0x74], esi
cmp byte [esi], 0x22
jne 0x501e8f
inc esi
mov dword [ebp - 0x74], esi
mov al, byte [esi]
test al, al
je 0x501df5
cmp al, 0x22
jne 0x501de7
cmp byte [esi], 0x22
jne 0x501dfe
inc esi
mov dword [ebp - 0x74], esi
mov al, byte [esi]
test al, al
je 0x501e0e
cmp al, 0x20
ja 0x501e0e
inc esi
mov dword [ebp - 0x74], esi
jmp 0x501dfe
mov dword [ebp - 0x30], 0
lea edx, [ebp - 0x5c]
push edx
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
test byte [ebp - 0x30], 1
je 0x501e2f
mov eax, dword [ebp - 0x2c]
and eax, 0xffff
jmp 0x501e34
mov eax, 0xa
push eax
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call main
mov dword [ebp - 0x68], eax
push eax
call dword [sym.imp.MSVCRT.dll_exit]
jmp 0x501e74
add esp, 4
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp byte [esi], 0x20
jbe 0x501dfe
inc esi
mov dword [ebp - 0x74], esi
jmp 0x501e8f