joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40c78f
Capabilities:
Get common file path

Disassembly:
push 0x318
push 0x42b050
call fcn.00412bf0
or dword [ebp - 0x1c], 0xffffffff
xor ebx, ebx
mov dword [ebp - 4], ebx
push dword [ebp + 8]
call fcn.0040b7d0
pop ecx
mov dword [ebp - 0x1c], eax
or dword [ebp - 4], 0xffffffff
jmp 0x40c7c6
cmp byte [0x43077c], 0
je 0x40c91f
mov byte [ebp - 0x328], bl
mov esi, 0x103
push esi
push ebx
lea eax, [ebp - 0x327]
push eax
call fcn.004122b0
add esp, 0xc
mov ecx, dword [0x42e66c]
lea eax, [ecx + 0xb4]
push eax
push 1
call fcn.00404c3d
cmp dword [eax], ebx
je 0x40c866
mov ecx, dword [0x42e66c]
lea eax, [ecx + 0xbc]
push eax
push 1
call fcn.00404c3d
cmp dword [eax], ebx
je 0x40c83a
mov ecx, dword [0x42e66c]
lea eax, [ecx + 0xbc]
push eax
push 1
call fcn.00404c3d
push ebx
call dword [eax]
mov esi, eax
jmp 0x40c83c
mov esi, ebx
mov ecx, dword [0x42e66c]
lea eax, [ecx + 0xb4]
push eax
push 1
call fcn.00404c3d
push 0x104
lea ecx, [ebp - 0x328]
push ecx
push esi
call dword [eax]
mov esi, 0x103
jmp 0x40c868
mov eax, ebx
test eax, eax
je 0x40c91f
mov byte [ebp - 0x120], bl
push esi
push ebx
lea eax, [ebp - 0x11f]
push eax
call fcn.004122b0
add esp, 0xc
call fcn.0040ca1a
cmp eax, 3
jae 0x40c8ad
push str.Global862
push ebx
push 0x1f0001
call dword [sym.imp.KERNEL32.dll_OpenMutexA]
test eax, eax
je 0x40c8ad
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov byte [ebp - 0x224], bl
push esi
push ebx
lea eax, [ebp - 0x223]
push eax
call fcn.004122b0
add esp, 0xc
lea eax, [ebp - 0x120]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
je 0x40c91f
cmp eax, 0xf2
ja 0x40c91f
lea eax, [ebp - 0x224]
push eax
push ebx
push 0x42e8d4
lea eax, [ebp - 0x120]
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
test eax, eax
je 0x40c91f
push 0x42e8d8
lea eax, [ebp - 0x224]
push eax
call fcn.004154c0
lea eax, [ebp - 0x328]
push eax
call fcn.0040b10b
add esp, 0xc
mov eax, dword [ebp - 0x1c]
call fcn.00412c2b
ret
Function at 0x40ca38
Capabilities:
Get common file path

Disassembly:
mov eax, 0x4205f1
call fcn.00412bcc
sub esp, 0x478
push ebx
push esi
call fcn.0040ca1a
mov esi, dword [sym.imp.KERNEL32.dll_SetEvent]
xor ebx, ebx
cmp eax, 3
jae 0x40ca73
push str.Local1764
push 1
push 1
push ebx
call dword [sym.imp.KERNEL32.dll_CreateEventA]
test eax, eax
je 0x40ca73
push eax
call esi
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x14], 0xf
mov dword [ebp - 0x18], ebx
mov byte [ebp - 0x28], bl
mov dword [ebp - 4], ebx
mov eax, dword [0x430780]
mov eax, dword [eax + 0x18]
test eax, eax
jne 0x40ca9d
cmp byte [eax], al
je 0x40cba6
call fcn.0040ca1a
cmp eax, 3
jae 0x40cabe
push str.Local1765
push 1
push 1
push ebx
call dword [sym.imp.KERNEL32.dll_CreateEventA]
test eax, eax
je 0x40cabe
push eax
call esi
call fcn.0040ca1a
cmp eax, 3
jae 0x40cada
lea eax, [ebp - 0x484]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
mov esi, dword [ebp + 8]
mov eax, dword [0x430780]
push dword [esi + 4]
push dword [eax + 0x18]
lea eax, [ebp - 0x40]
push str._s:_d
push eax
call fcn.0040743b
add esp, 0x10
mov byte [ebp - 4], 1
push eax
lea ecx, [ebp - 0x28]
call fcn.0040959e
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x40]
call fcn.004015ab
cmp dword [esi + 0xc], 0
je 0x40cb46
push dword [esi + 0xc]
lea eax, [ebp - 0x70]
push str._runtime_d_
push eax
call fcn.0040743b
add esp, 0xc
mov byte [ebp - 4], 2
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [ebp - 0x28]
call fcn.004050b9
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x70]
call fcn.004015ab
lea eax, [ebp + 0x10]
push eax
push dword [ebp + 0xc]
lea eax, [ebp - 0x58]
push eax
call fcn.0040743b
add esp, 0xc
mov byte [ebp - 4], 3
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [ebp - 0x28]
call fcn.004050b9
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x58]
call fcn.004015ab
call fcn.0040ca1a
cmp eax, 3
jae 0x40cb8b
lea eax, [ebp - 0x10]
push eax
mov dword [ebp - 0x10], ebx
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
cmp dword [ebp - 0x14], 0x10
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
push 0x42e77c
push 1
call fcn.00401617
add esp, 0xc
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.004015ab
mov ecx, dword [ebp - 0xc]
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x40cdf6
Capabilities:
Terminate process

Disassembly:
mov eax, 0x420632
call fcn.00412bcc
push esi
mov esi, 0x40ac2e
push esi
call dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
push esi
push 1
call dword [sym.imp.KERNEL32.dll_AddVectoredExceptionHandler]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
call fcn.00414f75
push 1
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.0040633b
push 0x484
call fcn.00401603
add esp, 0x14
mov dword [ebp + 8], eax
xor esi, esi
mov dword [ebp - 4], esi
test eax, eax
je 0x40ce56
push esi
push 0x2000003
mov ecx, eax
call fcn.0040141c
jmp 0x40ce58
mov eax, esi
or dword [ebp - 4], 0xffffffff
mov dword [0x42e66c], eax
call fcn.0040ca1a
cmp eax, 3
jae 0x40ce87
push str.Global571
push esi
push 0x1f0001
call dword [sym.imp.KERNEL32.dll_OpenMutexA]
test eax, eax
je 0x40ce87
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
cmp dword [0x42e66c], esi
jne 0x40cea1
or eax, 0xffffffff
mov ecx, dword [ebp - 0xc]
pop esi
mov dword fs:[0], ecx
leave
ret 0x10
push 0x4244f4
push dword [0x42e668]
call fcn.004155b0
pop ecx
pop ecx
test eax, eax
je 0x40cebc
push 0xfffffffffffffffe
pop eax
jmp 0x40ce92
push dword [ebp + 0x10]
call fcn.0040c78f
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x40e395
Capabilities:
Check for vm using instruction vpcext
Reference the vmware io port

Disassembly:
push 0xc
push 0x42b7e0
call fcn.00412bf0
mov dword [ebp - 0x1c], 0
and dword [ebp - 4], 0
push edx
push ecx
push ebx
mov eax, 0x564d5868
xor ebx, ebx
mov ecx, 0x14
mov edx, 0x5658
in eax, dx
cmp eax, 0x20
jl 0x40e3d5
cmp eax, 0x4000
jg 0x40e3d5
mov eax, 1
or dword [ebp - 0x1c], eax
pop ebx
pop ecx
pop edx
jmp 0x40e3e1
or dword [ebp - 4], 0xffffffff
mov dword [ebp - 4], 1
push ebx
xor eax, eax
xor ebx, ebx
inc eax
invalid

Function at 0x40eac7
Capabilities:
Get common file path

Disassembly:
push 0x830
push 0x42bc68
call fcn.00412bf0
and dword [ebp - 4], 0
call fcn.00411263
cmp eax, 3
jae 0x40eaf6
lea eax, [ebp - 0x42c]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
mov esi, dword fs:[0x30]
call fcn.00411263
cmp eax, 3
jae 0x40eb19
lea eax, [ebp - 0x840]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
test esi, esi
je 0x40eb39
push 4
push esi
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x40eb39
or dword [ebp - 4], 0xffffffff
mov eax, dword [esi]
jmp 0x40eb3f
or dword [ebp - 4], 0xffffffff
xor eax, eax
call fcn.00412c2b
ret
Function at 0x40ebe5
Capabilities:
Get common file path

Disassembly:
sub esp, 0x418
push ebx
push ebp
mov ebp, dword [esp + 0x424]
push esi
mov esi, dword [esp + 0x42c]
or ebx, 0xffffffff
test esi, esi
je 0x40ec79
push edi
dec esi
call fcn.00411263
cmp eax, 3
jae 0x40ec25
push str.979979
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
test eax, eax
je 0x40ec25
push eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
movzx eax, byte [ebp]
movzx ecx, bl
xor ecx, eax
push 8
mov dword [esp + 0x14], ecx
inc ebp
pop edi
call fcn.00411263
cmp eax, 3
jae 0x40ec54
lea eax, [esp + 0x14]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
mov ecx, dword [esp + 0x10]
test cl, 1
je 0x40ec64
shr ecx, 1
xor ecx, dword [esp + 0x434]
jmp 0x40ec66
shr ecx, 1
dec edi
mov dword [esp + 0x10], ecx
test edi, edi
jg 0x40ec36
shr ebx, 8
xor ebx, ecx
test esi, esi
jne 0x40ec04
pop edi
pop esi
not ebx
pop ebp
mov eax, ebx
pop ebx
add esp, 0x418
ret

Function at 0x40ec87
Capabilities:
Delete directory

Disassembly:
mov edi, edi
push esi
mov esi, dword [0x4307a0]
jmp 0x40eca8
cmp dword [esi + 0x14], 0x10
jb 0x40ec9c
mov eax, dword [esi]
jmp 0x40ec9e
mov eax, esi
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
add esi, 0x18
cmp esi, dword [0x4307a4]
jne 0x40ec92
pop esi
ret
Function at 0x41056c
Capabilities:
Get common file path

Disassembly:
mov eax, 0x420b5c
call fcn.00412bcc
sub esp, 0x430
push ebx
xor ebx, ebx
push edi
mov dword [ebp - 0x10], ebx
call fcn.00411263
cmp eax, 3
jae 0x41059f
lea eax, [ebp - 0x43c]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
call fcn.00411263
cmp eax, 3
jae 0x4105c5
push str.Global992
push ebx
push 0x1f0001
call dword [sym.imp.KERNEL32.dll_OpenMutexA]
test eax, eax
je 0x4105c5
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
cmp dword [ebp + 0xc], ebx
je 0x410655
push dword [ebp + 0xc]
lea ecx, [ebp - 0x28]
call fcn.004013ed
xor edi, edi
inc edi
mov dword [ebp - 4], edi
push dword [0x42d1e0]
cmp dword [0x42d1e4], 0x10
mov eax, 0x42d1d0
cmovae eax, dword [0x42d1d0]
push 0xffffffffffffffff
push eax
lea ecx, [ebp - 0x28]
call fcn.004100a5
cmp eax, 0xffffffff
je 0x410627
push 0xffffffffffffffff
inc eax
push eax
push dword [ebp + 8]
lea ecx, [ebp - 0x28]
call fcn.004062fc
mov dword [ebp - 0x10], edi
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x28]
call fcn.004015ab
jmp 0x41066c
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x28]
mov dword [esi + 0x14], 0xf
mov dword [esi + 0x10], ebx
push eax
mov ecx, esi
mov byte [esi], bl
call fcn.00404f10
mov dword [ebp - 0x10], edi
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x28]
call fcn.004015ab
mov eax, esi
pop esi
jmp 0x41066f
mov ecx, dword [ebp + 8]
push 0x424534
call fcn.004013ed
mov dword [ebp - 4], ebx
mov dword [ebp - 0x10], 1
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
pop edi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x410f89
Capabilities:
Check if file exists
Create directory
Get common file path
Get file attributes

Disassembly:
mov eax, 0x420c99
call fcn.00412bcc
sub esp, 0x42c
call fcn.00411263
cmp eax, 3
jae 0x410fb5
lea eax, [ebp - 0x438]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
push esi
mov esi, dword [ebp + 8]
push edi
cmp dword [esi + 0x14], 0x10
jb 0x410fc4
mov eax, dword [esi]
jmp 0x410fc6
mov eax, esi
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x411061
push dword [0x42d1e0]
cmp dword [0x42d1e4], 0x10
mov eax, 0x42d1d0
cmovae eax, dword [0x42d1d0]
push 0xffffffffffffffff
push eax
mov ecx, esi
call fcn.004100a5
mov edi, dword [ebp + 0xc]
cmp eax, 0xffffffff
je 0x411038
push ebx
push eax
push 0
lea eax, [ebp - 0x24]
push eax
mov ecx, esi
call fcn.004062fc
and dword [ebp - 4], 0
push edi
push eax
call fcn.00410f89
mov bl, al
pop ecx
neg bl
pop ecx
sbb bl, bl
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x24]
call fcn.004015ab
inc bl
pop ebx
je 0x411038
xor al, al
jmp 0x411070
cmp dword [esi + 0x14], 0x10
jb 0x411042
mov eax, dword [esi]
jmp 0x411044
mov eax, esi
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
je 0x411034
push esi
mov ecx, 0x43078c
call fcn.004110b1
mov byte [edi], 0
jmp 0x41106e
test eax, 0x410
je 0x411034
mov ecx, dword [ebp + 0xc]
mov byte [ecx], 1
mov al, 1
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret
Function at 0x411116
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, 0x420c6b
call fcn.00412bcc
mov eax, 0x1038
call fcn.00413020
push ebx
push ebp
push esi
xor ebx, ebx
push edi
mov dword [esp + 0x1050], ebx
lea eax, [esp + 0x14]
push eax
push 0x20019
push ebx
push dword [esp + 0x1070]
mov dword [esp + 0x2c], ebx
push dword [esp + 0x1070]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, dword [esp + 0x105c]
push 0xf
pop edi
mov dword [esi + 0x14], edi
mov dword [esi + 0x10], ebx
mov byte [esi], bl
mov dword [esp + 0x1050], ebx
xor ebp, ebp
inc ebp
mov dword [esp + 0x1c], ebp
test eax, eax
jne 0x411234
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x48]
push eax
lea eax, [esp + 0x20]
push eax
push ebx
push dword [esp + 0x1078]
mov dword [esp + 0x24], 0x1000
push dword [esp + 0x28]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, dword [esp + 0x10]
mov byte [esp + ecx + 0x44], bl
test eax, eax
jne 0x41120b
mov eax, dword [esp + 0x18]
dec eax
cmp eax, 2
ja 0x41124a
push ecx
lea eax, [esp + 0x48]
mov dword [esp + 0x34], ebx
mov dword [esp + 0x38], ebx
push eax
lea ecx, [esp + 0x28]
mov dword [esp + 0x3c], edi
mov dword [esp + 0x38], ebx
mov byte [esp + 0x28], bl
call fcn.00404022
mov dword [esp + 0x1050], ebp
lea eax, [esp + 0x20]
push eax
mov ecx, esi
call fcn.0040959e
mov byte [esp + 0x1050], bl
lea ecx, [esp + 0x20]
call fcn.004015ab
push dword [esp + 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call fcn.00411263
cmp eax, 3
jae 0x411234
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateEventA]
test eax, eax
je 0x411234
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x1048]
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
leave
ret
lea ecx, [esp + 0x38]
call fcn.00412a77
push 0x42b1bc
lea eax, [esp + 0x3c]
push eax
call fcn.00412b6e
int3

Function at 0x41130f
Capabilities:
Delete directory

Disassembly:
mov eax, 0x420c87
call fcn.00412bcc
sub esp, 0x1c
cmp dword [0x43079c], 0
je 0x411389
push esi
mov esi, 0x43078c
mov ecx, esi
call fcn.0040ebbe
push eax
lea ecx, [ebp - 0x28]
call fcn.0040a17b
and dword [ebp - 4], 0
mov ecx, esi
call fcn.0041107e
call fcn.00411263
cmp eax, 3
jae 0x411361
lea eax, [ebp - 0x10]
push eax
mov dword [ebp - 0x10], 0
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
cmp dword [ebp - 0x14], 0x10
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.004015ab
cmp dword [0x43079c], 0
jne 0x41132b
pop esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
leave
ret
Function at 0x41da77
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x42d580]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [fcn.004117fe]
push esi
push edi
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0xc]
xor edi, edi
push edi
mov dword [ebp - 0x20], eax
call ebx
mov esi, eax
mov dword [ebp - 0x18], esi
call fcn.00415d77
mov dword [ebp - 0x14], eax
cmp dword [0x431618], edi
jne 0x41db68
push 0x800
push edi
push 0x426898
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov esi, eax
test esi, esi
jne 0x41daf5
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x41dc48
push 0x426898
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
test esi, esi
je 0x41dc48
push str.MessageBoxW
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x41dc48
push eax
call ebx
push str.GetActiveWindow
push esi
mov dword [0x431618], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push esi
mov dword [0x43161c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push esi
mov dword [0x431620], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x431628], eax
test eax, eax
je 0x41db65
push str.GetProcessWindowStation
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x431624], eax
mov esi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x41db8d
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x41db80
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], edi
je 0x41dba2
push 4
pop eax
jmp 0x41dc4a
cmp dword [ebp - 0x14], edi
je 0x41dba2
push dword [0x431618]
call dword [fcn.00411802]
push 3
jmp 0x41db87
mov eax, dword [0x431624]
mov ebx, dword [fcn.00411802]
cmp eax, esi
je 0x41dc00
cmp dword [0x431628], esi
je 0x41dc00
push eax
call ebx
push dword [0x431628]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x41dc00
test eax, eax
je 0x41dc00
call ecx
test eax, eax
je 0x41dbf5
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x41dbf5
test byte [ebp - 8], 1
jne 0x41dc00
mov esi, dword [ebp + 0x10]
or esi, 0x200000
jmp 0x41dc30
mov eax, dword [0x43161c]
cmp eax, esi
je 0x41dc2d
push eax
call ebx
test eax, eax
je 0x41dc2d
call eax
mov edi, eax
test edi, edi
je 0x41dc2d
mov eax, dword [0x431620]
cmp eax, esi
je 0x41dc2d
push eax
call ebx
test eax, eax
je 0x41dc2d
push edi
call eax
mov edi, eax
mov esi, dword [ebp + 0x10]
push dword [0x431618]
call ebx
test eax, eax
je 0x41dc48
push esi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push edi
call eax
jmp 0x41dc4a
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00415aec
leave
ret
Function at 0xd4a60
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, dword [0xfb010]
push edi
push 0x1049f0
call esi
push 0x1049f0
call esi
push 0x1049f0
call esi
push 0x1049f0
call esi
push 0x1049f0
call esi
mov edi, dword [ebp + 0x10]
lea eax, [edi + 1]
push eax
push 0
call 0x4ad024a
nop
push eax
nop
call 0x77ba5da0
mov ebx, eax
push 0x1049f0
mov dword [ebp - 4], ebx
call esi
push 0x1049f0
call esi
push 0x1049f0
call esi
push 0x1049f0
call esi
push 0x1049f0
call esi
push 0x1049f0
mov byte [ebx + edi], 0
call esi
push 0x1049f0
call esi
push 0x1049f0
call esi
push 0x1049f0
call esi
push 0x1049f0
call esi
xor edi, edi
cmp dword [ebp + 0x10], edi
jbe 0xd4b7a
mov eax, dword [ebp + 8]
sub eax, ebx
mov dword [ebp - 8], eax
push 0x1049f0
call esi
push 0x1049f0
call esi
push 0x1049f0
call esi
push 0x1049f0
call esi
push 0x1049f0
call esi
mov ecx, dword [ebp + 0xc]
push ecx
add ebx, edi
nop
call 0x763097f0
mov ecx, eax
xor edx, edx
mov eax, edi
div ecx
mov eax, dword [ebp + 0xc]
add esp, 4
push 0x1049f0
mov cl, byte [edx + eax]
mov edx, dword [ebp - 8]
xor cl, byte [edx + ebx]
mov byte [ebx], cl
call esi
push 0x1049f0
call esi
push 0x1049f0
call esi
push 0x1049f0
call esi
push 0x1049f0
call esi
mov ebx, dword [ebp - 4]
inc edi
cmp edi, dword [ebp + 0x10]
jb 0xd4b06
push 0x1049f0
call esi
push 0x1049f0
call esi
push 0x1049f0
call esi
push 0x1049f0
call esi
push 0x1049f0
call esi
lea eax, [ebp - 0xc]
push eax
push 0x100
push 4
push ebx
mov dword [ebp - 0xc], 0
call 0x4ad0250
nop
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0xd6ef0
Capabilities:
Parse pe header

Disassembly:
cmp dword [ebx + 4], 0x40
jb 0xd6f91
mov eax, dword [ebx]
push 0x40
push eax
push esi
nop
call 0x76308cf0
mov ecx, 0x5a4d
add esp, 0xc
cmp word [esi], cx
jne 0xd6fc0
mov eax, dword [esi + 0x3c]
test eax, eax
je 0xd6fc0
lea edx, [eax + 0xf8]
cmp edx, dword [ebx + 4]
ja 0xd6f91
mov ecx, dword [ebx]
push edi
push 0xf8
add ecx, eax
push ecx
lea edi, [esi + 0x40]
push edi
call 0x76308cf0
nop
add esp, 0xc
cmp dword [edi], 0x4550
pop edi
jne 0xd6fc0
mov edx, 0x10b
cmp word [esi + 0x58], dx
jne 0xd6fc0
movzx eax, word [esi + 0x46]
test ax, ax
je 0xd6fc0
lea eax, [eax + eax*4]
add eax, eax
add eax, eax
add eax, eax
push eax
push 8
mov dword [esi + 0x140], eax
call dword [fcn.003090f4]
push eax
call dword [fcn.00309088]
mov dword [esi + 0x138], eax
test eax, eax
jne 0xd6f97
mov eax, 3
ret
mov eax, 1
ret
movzx ecx, word [esi + 0x54]
mov edx, dword [esi + 0x3c]
lea ecx, [ecx + edx + 0x18]
mov edx, dword [esi + 0x140]
push ebx
push edx
push ecx
push eax
mov dword [esi + 0x13c], ecx
call fcn.000d7590
add esp, 0x10
neg eax
sbb eax, eax
inc eax
ret
mov eax, 2
ret
Function at 0x5d1d00
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
mov esi, dword [0x3090e0]
test esi, esi
jne 0x5d1d18
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
mov eax, 0x5a4d
cmp word [esi], ax
jne 0x5d1d11
mov eax, dword [esi + 0x3c]
cmp dword [eax + esi], 0x4550
jne 0x5d1d11
mov eax, dword [eax + esi + 0x78]
mov ecx, dword [eax + esi + 0x1c]
add eax, esi
add ecx, esi
push ebx
mov ebx, dword [eax + 0x20]
mov dword [ebp - 0xc], ecx
mov ecx, dword [eax + 0x24]
mov eax, dword [eax + 0x18]
push edi
add ecx, esi
add ebx, esi
xor edi, edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
test eax, eax
je 0x5d1d7a
jmp 0x5d1d60
mov eax, dword [ebx + edi*4]
mov ecx, dword [0x308bf0]
add eax, esi
call fcn.005cf7e0
test eax, eax
je 0x5d1d83
inc edi
cmp edi, dword [ebp - 4]
jb 0x5d1d60
pop edi
pop ebx
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 8]
movzx edx, word [ecx + edi*2]
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + edx*4]
pop edi
pop ebx
add eax, esi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x5f7c9a
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2bc
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x5f7cb5
add esi, 0x1000
lea eax, [ebp - 0x2bc]
push edx
push 0x1c
push eax
push esi
call dword [edx + 0x124bceda]
pop edx
test eax, eax
je 0x5f7d87
cmp dword [ebp - 0x2ac], 0x1000
jne 0x5f7d76
test dword [ebp - 0x2a8], 1
jne 0x5f7d76
and dword [ebp - 0x2a8], 0x100
jne 0x5f7d76
push esi
push edx
push 4
push esi
call dword [edx + 0x122d2d6c]
pop edx
pop esi
test eax, eax
je 0x5f7d19
jmp 0x5f7d76
cmp word [esi], 0x5a4d
jne 0x5f7d76
mov eax, esi
push ebx
mov ebx, dword [esi + 0x3c]
add eax, ebx
pop ebx
cmp dword [eax], 0x4550
jne 0x5f7d76
lea eax, [ebp - 0x28c]
push edx
push 0x28a
push eax
push esi
call dword [edx + 0x122d30b8]
pop edx
test eax, eax
je 0x5f7d76
lea eax, [ebp - 0x28c]
push eax
call fcn.005f7bf6
test eax, eax
jne 0x5f7d6f
jmp 0x5f7d76
mov eax, esi
jmp 0x5f7d87
mov esi, dword [ebp - 0x2b0]
add esi, dword [ebp - 0x2bc]
jmp 0x5f7cb5
pop esi
leave
ret 4

Function at 0x41caa0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x14000]
push edi
or ebp, 0xffffffff
jmp 0x41cac2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x41cac9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x41cab8
mov eax, 1
add ebx, ebx
jne 0x41cadb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x41cad0
jne 0x41caec
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x41cad0
xor ecx, ecx
sub eax, 3
jb 0x41cb00
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x41cb72
mov ebp, eax
add ebx, ebx
jne 0x41cb0b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x41cb18
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x41cb3c
inc ecx
add ebx, ebx
jne 0x41cb28
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x41cb1d
jne 0x41cb39
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x41cb1d
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x41cb5c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x41cb4d
jmp 0x41cabe
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x41cb5c
add edi, ecx
jmp 0x41cabe
pop esi
mov edi, esi
mov ecx, 0x466
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x41cb7a
cmp byte [edi], 6
jne 0x41cb7a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov eax, ebx
loop 0x41cb7f
lea edi, [esi + 0x1a000]
mov eax, dword [edi]
or eax, eax
je 0x41cbee
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x1c068]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x1c0cc]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x41cbac
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x1c0d0]
or eax, eax
je 0x41cbe8
mov dword [ebx], eax
add ebx, 4
jmp 0x41cbc9
call dword [esi + 0x1c0d4]
popal
jmp section.UPX0