joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4046e2
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x68
mov eax, dword [ebp + 8]
push ebx
xor ebx, ebx
cmp eax, ebx
mov dword [ebp - 0xc], ebx
mov byte [ebp - 1], bl
je 0x40470d
cmp eax, 1
je 0x40470d
jle 0x404715
cmp eax, 3
jle 0x40470d
cmp eax, 4
jne 0x404715
mov byte [ebp - 1], 1
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x10], eax
jmp 0x40473e
mov dword [0x40b42c], 0x16
mov dword [0x40b430], ebx
or eax, 0xffffffff
jmp 0x4048b0
inc eax
cmp byte [eax], bl
jne 0x40472d
lea ecx, [eax + 1]
cmp byte [ecx], bl
je 0x40473e
mov byte [eax], 0x20
mov eax, ecx
cmp byte [eax], bl
jne 0x40472d
push esi
push 0x44
pop esi
push esi
lea eax, [ebp - 0x68]
push ebx
push eax
call fcn.00406660
mov dword [ebp - 0x68], esi
mov esi, dword [0x40b888]
add esp, 0xc
cmp esi, ebx
je 0x404781
lea eax, [esi - 1]
mov ecx, eax
sar ecx, 5
mov ecx, dword [ecx*4 + 0x40b8a0]
mov edx, eax
and edx, 0x1f
cmp byte [ecx + edx*8 + 4], bl
jne 0x404781
dec esi
dec eax
cmp esi, ebx
jne 0x404764
lea eax, [esi + esi*4 + 4]
mov word [ebp - 0x36], ax
push edi
movzx eax, ax
push 1
push eax
call fcn.004065e2
cmp esi, ebx
mov dword [ebp - 0x34], eax
pop ecx
mov dword [eax], esi
mov eax, dword [ebp - 0x34]
pop ecx
mov dword [ebp - 8], ebx
lea ecx, [eax + 4]
lea edx, [eax + esi + 4]
jle 0x4047e6
mov eax, dword [ebp - 8]
mov edi, dword [ebp - 8]
sar eax, 5
mov eax, dword [eax*4 + 0x40b8a0]
and edi, 0x1f
lea edi, [eax + edi*8]
mov al, byte [edi + 4]
test al, 0x10
jne 0x4047d2
mov byte [ecx], al
mov eax, dword [edi]
mov dword [edx], eax
jmp 0x4047d7
mov byte [ecx], bl
or dword [edx], 0xffffffff
inc dword [ebp - 8]
inc ecx
add edx, 4
cmp dword [ebp - 8], esi
jl 0x4047ad
mov eax, dword [ebp - 0x34]
cmp byte [ebp - 1], bl
je 0x404817
lea ecx, [eax + 4]
xor edx, edx
lea eax, [eax + esi + 4]
cmp esi, 3
jge 0x4047fd
mov edi, esi
jmp 0x404800
push 3
pop edi
cmp edx, edi
jge 0x404810
mov byte [ecx], bl
or dword [eax], 0xffffffff
inc edx
inc ecx
add eax, 4
jmp 0x4047f4
mov dword [ebp - 0xc], 8
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x68]
push eax
push ebx
push dword [ebp + 0x14]
mov dword [0x40b42c], ebx
push dword [ebp - 0xc]
mov dword [0x40b430], ebx
push 1
push ebx
push ebx
push dword [ebp - 0x10]
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push dword [ebp - 0x34]
mov edi, eax
call fcn.004042b9
cmp esi, ebx
pop ecx
jne 0x404865
push edi
call fcn.00404ac0
pop ecx
or eax, 0xffffffff
jmp 0x4048ae
cmp dword [ebp + 8], 2
jne 0x404871
push ebx
call fcn.004033d6
cmp dword [ebp + 8], ebx
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
jne 0x40489e
push 0xffffffffffffffff
push dword [ebp - 0x24]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0x24]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov ebx, dword [ebp - 0x14]
push dword [ebp - 0x24]
call esi
jmp 0x4048a7
cmp dword [ebp + 8], 4
je 0x404897
mov ebx, dword [ebp - 0x24]
push dword [ebp - 0x20]
call esi
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x404bee
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
xor ebx, ebx
cmp dword [0x40b594], ebx
push esi
push edi
jne 0x404c6e
push str.user32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x404ca9
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x409724
push edi
call esi
test eax, eax
mov dword [0x40b594], eax
je 0x404ca9
push str.GetActiveWindow
push edi
call esi
push str.GetLastActivePopup
push edi
mov dword [0x40b598], eax
call esi
cmp dword [0x40b438], 2
mov dword [0x40b59c], eax
jne 0x404c6e
push str.GetUserObjectInformationA
push edi
call esi
test eax, eax
mov dword [0x40b5a4], eax
je 0x404c6e
push str.GetProcessWindowStation
push edi
call esi
mov dword [0x40b5a0], eax
mov eax, dword [0x40b5a0]
test eax, eax
je 0x404cb3
call eax
test eax, eax
je 0x404c9a
lea ecx, [ebp - 4]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [0x40b5a4]
test eax, eax
je 0x404c9a
test byte [ebp - 8], 1
jne 0x404cb3
cmp dword [0x40b444], 4
jb 0x404cad
or byte [ebp + 0x12], 0x20
jmp 0x404cd2
xor eax, eax
jmp 0x404ce2
or byte [ebp + 0x12], 4
jmp 0x404cd2
mov eax, dword [0x40b598]
test eax, eax
je 0x404cd2
call eax
mov ebx, eax
test ebx, ebx
je 0x404cd2
mov eax, dword [0x40b59c]
test eax, eax
je 0x404cd2
push ebx
call eax
mov ebx, eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push ebx
call dword [0x40b594]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4061ce
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, dword [esi + 8]
test bl, 3
jne 0x4061fc
mov eax, dword fs:[0x18]
mov dword [ebp + 8], eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 8]
cmp ebx, ecx
mov dword [ebp - 4], ecx
jb 0x406203
cmp ebx, dword [eax + 4]
jae 0x406203
xor eax, eax
jmp 0x4063f3
push edi
mov edi, dword [esi + 0xc]
cmp edi, 0xffffffff
jne 0x406214
xor eax, eax
inc eax
jmp 0x4063f2
xor edx, edx
mov dword [ebp + 8], edx
mov eax, ebx
mov ecx, dword [eax]
cmp ecx, 0xffffffff
je 0x40622a
cmp ecx, edx
jae 0x40636f
cmp dword [eax + 4], 0
je 0x406233
inc dword [ebp + 8]
inc edx
add eax, 0xc
cmp edx, edi
jbe 0x40621b
cmp dword [ebp + 8], 0
je 0x406255
mov eax, dword [esi - 8]
cmp eax, dword [ebp - 4]
jb 0x40636f
cmp eax, esi
jae 0x40636f
mov eax, dword [0x40b5b0]
mov edi, ebx
and edi, 0xfffff000
xor esi, esi
test eax, eax
jle 0x40627a
cmp dword [esi*4 + 0x40b5b8], edi
je 0x406373
inc esi
cmp esi, eax
jl 0x406268
push 0x1c
lea eax, [ebp - 0x20]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x4063ef
cmp dword [ebp - 8], 0x1000000
jne 0x4063ef
test byte [ebp - 0xc], 0xcc
je 0x4062f8
mov ecx, dword [ebp - 0x1c]
cmp word [ecx], 0x5a4d
jne 0x4063ef
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x4063ef
cmp word [eax + 0x18], 0x10b
jne 0x4063ef
sub ebx, ecx
cmp word [eax + 6], 0
movzx ecx, word [eax + 0x14]
lea ecx, [ecx + eax + 0x18]
jbe 0x4063ef
mov eax, dword [ecx + 0xc]
cmp ebx, eax
jb 0x4062f8
mov edx, dword [ecx + 8]
add edx, eax
cmp ebx, edx
jae 0x4062f8
test byte [ecx + 0x27], 0x80
jne 0x40636f
push 1
push 0x40b5f8
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
test eax, eax
jne 0x40620c
mov ecx, dword [0x40b5b0]
test ecx, ecx
mov edx, ecx
jle 0x40632c
lea eax, [ecx*4 + 0x40b5b4]
cmp dword [eax], edi
je 0x40632c
dec edx
sub eax, 4
test edx, edx
jg 0x406320
test edx, edx
jne 0x40635d
push 0xf
pop ebx
cmp ecx, ebx
jg 0x406339
mov ebx, ecx
xor edx, edx
test ebx, ebx
jl 0x406351
lea eax, [edx*4 + 0x40b5b8]
mov esi, dword [eax]
inc edx
cmp edx, ebx
mov dword [eax], edi
mov edi, esi
jle 0x40633f
cmp ecx, 0x10
jge 0x40635d
inc ecx
mov dword [0x40b5b0], ecx
push 0
push 0x40b5f8
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
jmp 0x40620c
xor eax, eax
jmp 0x4063f2
test esi, esi
jle 0x40620c
mov ebx, dword [sym.imp.KERNEL32.dll_InterlockedExchange]
push 1
push 0x40b5f8
call ebx
test eax, eax
jne 0x40620c
cmp dword [esi*4 + 0x40b5b8], edi
je 0x4063c9
mov eax, dword [0x40b5b0]
lea esi, [eax - 1]
test esi, esi
jl 0x4063b7
cmp dword [esi*4 + 0x40b5b8], edi
je 0x4063b3
dec esi
jns 0x4063a7
test esi, esi
jge 0x4063c7
cmp eax, 0x10
jge 0x4063c2
inc eax
mov dword [0x40b5b0], eax
lea esi, [eax - 1]
jmp 0x4063c9
je 0x4063e1
xor ecx, ecx
test esi, esi
jl 0x4063e1
lea eax, [ecx*4 + 0x40b5b8]
mov edx, dword [eax]
inc ecx
cmp ecx, esi
mov dword [eax], edi
mov edi, edx
jle 0x4063cf
push 0
push 0x40b5f8
call ebx
jmp 0x40620c
or eax, 0xffffffff
pop edi
pop esi
pop ebx
leave
ret
Function at 0x406b0e
Capabilities:
Set environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
push ebx
xor ebx, ebx
cmp eax, ebx
push edi
mov dword [ebp - 0x10], ebx
jne 0x406b27
or eax, 0xffffffff
jmp 0x406b88
push esi
mov esi, dword [eax]
cmp esi, ebx
mov dword [ebp - 4], esi
je 0x406b84
push 0x3d
push esi
call fcn.004045bf
cmp eax, ebx
pop ecx
pop ecx
mov dword [ebp - 0xc], eax
je 0x406b84
cmp esi, eax
je 0x406b84
xor ecx, ecx
cmp byte [eax + 1], bl
mov eax, dword [0x40b458]
sete cl
cmp eax, dword [0x40b45c]
mov dword [ebp - 8], ecx
jne 0x406b6a
mov edi, eax
call fcn.00406aad
mov dword [0x40b458], eax
cmp eax, ebx
jne 0x406bc3
cmp dword [ebp + 0xc], ebx
je 0x406b8c
cmp dword [0x40b460], ebx
je 0x406b8c
call fcn.00404b5e
test eax, eax
je 0x406bc3
or eax, 0xffffffff
pop esi
pop edi
pop ebx
leave
ret
cmp dword [ebp - 8], ebx
je 0x406b95
xor eax, eax
jmp 0x406b87
push 4
call fcn.004045ad
cmp eax, ebx
pop ecx
mov dword [0x40b458], eax
je 0x406b84
mov dword [eax], ebx
cmp dword [0x40b460], ebx
jne 0x406bc3
push 4
call fcn.004045ad
cmp eax, ebx
pop ecx
mov dword [0x40b460], eax
je 0x406b84
mov dword [eax], ebx
mov edi, dword [ebp - 0xc]
sub edi, dword [ebp - 4]
push dword [ebp - 4]
mov esi, dword [0x40b458]
call fcn.00406a60
mov edi, eax
cmp edi, ebx
pop ecx
jl 0x406c24
cmp dword [esi], ebx
je 0x406c24
lea esi, [esi + edi*4]
push dword [esi]
call fcn.004042b9
cmp dword [ebp - 8], ebx
pop ecx
jne 0x406c07
mov eax, dword [ebp - 4]
mov dword [esi], eax
mov eax, dword [ebp + 8]
mov dword [eax], ebx
jmp 0x406c65
mov eax, dword [esi + 4]
mov dword [esi], eax
inc edi
add esi, 4
cmp dword [esi], ebx
jne 0x406bfe
mov eax, edi
shl eax, 2
push eax
push dword [0x40b458]
call fcn.00406448
cmp eax, ebx
pop ecx
pop ecx
je 0x406c65
jmp 0x406c60
cmp dword [ebp - 8], ebx
jne 0x406cd0
cmp edi, ebx
jge 0x406c33
neg edi
lea eax, [edi*4 + 8]
push eax
push dword [0x40b458]
call fcn.00406448
cmp eax, ebx
pop ecx
pop ecx
je 0x406b84
mov edx, dword [ebp - 4]
lea ecx, [eax + edi*4]
mov dword [ecx], edx
mov dword [ecx + 4], ebx
mov ecx, dword [ebp + 8]
mov dword [ecx], ebx
mov dword [0x40b458], eax
cmp dword [ebp + 0xc], ebx
je 0x406cba
push dword [ebp - 4]
call fcn.004044b0
inc eax
inc eax
push eax
call fcn.004045ad
mov esi, eax
cmp esi, ebx
pop ecx
pop ecx
je 0x406cba
push dword [ebp - 4]
push esi
call fcn.00404360
mov eax, esi
sub eax, dword [ebp - 4]
pop ecx
add eax, dword [ebp - 0xc]
pop ecx
mov ecx, dword [ebp - 8]
mov byte [eax], bl
inc eax
neg ecx
sbb ecx, ecx
not ecx
and ecx, eax
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
test eax, eax
jne 0x406cb3
or dword [ebp - 0x10], 0xffffffff
push esi
call fcn.004042b9
pop ecx
cmp dword [ebp - 8], ebx
je 0x406cc8
push dword [ebp - 4]
call fcn.004042b9
pop ecx
mov eax, dword [ebp - 0x10]
jmp 0x406b87
push dword [ebp - 4]
call fcn.004042b9
mov eax, dword [ebp + 8]
pop ecx
mov dword [eax], ebx
jmp 0x406b91
Function at 0x407959
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
push ebx
push esi
push edi
push 4
pop eax
call fcn.00402de0
mov esi, esp
push 0x1c
lea eax, [ebp - 0x28]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x4079f4
mov ebx, dword [ebp - 0x24]
lea eax, [ebp - 0x4c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ecx, dword [ebp - 0x48]
mov eax, dword [0x40b438]
lea edi, [ecx - 1]
not edi
and edi, esi
sub edi, ecx
mov esi, eax
dec esi
neg esi
sbb esi, esi
and esi, 0xfffffff1
add esi, 0x11
imul esi, ecx
add esi, ebx
cmp edi, esi
mov dword [ebp - 8], ecx
jb 0x4079f4
cmp eax, 1
je 0x407a15
mov dword [ebp - 4], ebx
mov ebx, 0x1000
push 0x1c
lea eax, [ebp - 0x28]
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x4079f4
mov eax, dword [ebp - 0x1c]
add dword [ebp - 4], eax
test dword [ebp - 0x18], ebx
je 0x4079c1
test byte [ebp - 0x13], 1
mov eax, dword [ebp - 0x28]
mov dword [ebp - 4], eax
je 0x4079f0
xor eax, eax
inc eax
jmp 0x407a34
cmp edi, eax
jae 0x4079f8
xor eax, eax
jmp 0x407a34
cmp eax, esi
jae 0x4079ff
mov dword [ebp - 4], esi
push 4
push ebx
push dword [ebp - 8]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov eax, dword [0x40b438]
jmp 0x407a18
mov dword [ebp - 4], edi
dec eax
neg eax
sbb eax, eax
and eax, 0x103
lea ecx, [ebp - 0xc]
push ecx
inc eax
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea esp, [ebp - 0x58]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4295fb
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
movsx eax, word [0x436b3a]
push ebx
push esi
push dword [0x436b50]
push eax
call fcn.0041164a
push dword [0x436b64]
add word [0x436b38], ax
push dword [0x436b60]
call fcn.00411673
mov esi, dword [ebp + 8]
mov dword [0x436b48], eax
mov ecx, dword [esi + 4]
mov ebx, dword [esi]
inc byte [0x436b2b]
mov dword [ebp + 8], ecx
movsx ecx, word [0x436b38]
push ecx
push eax
call fcn.0041160e
and dword [ebp - 4], 0
mov word [0x436b40], ax
mov al, byte [0x436b28]
add esp, 0x18
sub al, byte [0x436b2b]
cmp dword [ebp + 0x10], 0
mov byte [0x436b2d], al
jle 0x42976a
push edi
inc bl
push 0x7847ffff
movzx eax, bl
mov ebx, dword [esi + eax*4 + 8]
push dword [0x436b68]
lea edi, [esi + eax*4 + 8]
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], ebx
call fcn.004115bd
add dword [0x436b54], eax
mov al, byte [0x436b2e]
add bl, byte [ebp + 8]
inc al
mov byte [0x436b29], al
dec al
add byte [0x436b2b], al
push 0xaa87ffff
movzx eax, bl
mov ebx, dword [esi + eax*4 + 8]
mov dword [ebp + 8], eax
lea eax, [esi + eax*4 + 8]
mov dword [edi], ebx
mov dword [ebp - 0x10], eax
xor eax, eax
cmp byte [0x436b2f], al
push dword [0x436b68]
setne al
add word [0x436b38], ax
movsx eax, word [0x436b32]
and eax, 0xa3b9ffff
mov dword [0x436b6c], eax
call fcn.004114d1
add byte [0x436b2b], al
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x10]
mov edi, dword [ebp - 4]
add bl, cl
add esp, 0x10
mov dword [eax], ecx
mov eax, dword [ebp + 0xc]
movzx ecx, bl
add eax, edi
mov cl, byte [esi + ecx*4 + 8]
xor byte [eax], cl
call dword [fcn.0042f264]
add dword [0x436b60], eax
mov eax, dword [0x436b48]
add eax, 0x85d7ffff
mov dword [0x436b4c], eax
movsx eax, byte [0x436b30]
push eax
push 0xcd91ffff
call fcn.004116aa
mov ebx, dword [ebp - 8]
inc edi
cmp edi, dword [ebp + 0x10]
pop ecx
pop ecx
mov word [0x436b3c], ax
mov dword [ebp - 4], edi
jl 0x42967a
pop edi
push 0x159bffff
push 0x871fffff
call fcn.004116aa
add word [0x436b34], ax
mov dword [esi], ebx
mov al, byte [0x436b38]
pop ecx
imul byte [0x436b4c]
cmp dword [0x436b68], 0
mov byte [0x436b29], al
pop ecx
setne al
mov byte [0x436b28], al
call dword [fcn.0042f014]
add word [0x436b32], ax
mov eax, dword [ebp + 8]
mov dword [esi + 4], eax
pop esi
pop ebx
leave
ret
Function at 0x43a210
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x24000]
push edi
jmp 0x43a22a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x43a231
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x43a220
mov eax, 1
add ebx, ebx
jne 0x43a243
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x43a238
jne 0x43a254
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x43a238
xor ecx, ecx
sub eax, 3
jb 0x43a268
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x43a2da
mov ebp, eax
add ebx, ebx
jne 0x43a273
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x43a280
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x43a2a4
inc ecx
add ebx, ebx
jne 0x43a290
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x43a285
jne 0x43a2a1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x43a285
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x43a2c4
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x43a2b5
jmp 0x43a226
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x43a2c4
add edi, ecx
jmp 0x43a226
pop esi
mov edi, esi
mov ecx, 0x128d
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x43a2e2
cmp byte [edi], 7
jne 0x43a2e2
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x43a2e7
lea edi, [esi + 0x37000]
mov eax, dword [edi]
or eax, eax
je 0x43a35f
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x3a000]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x3a0b4]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x43a314
mov ecx, edi
jns 0x43a343
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x3a0b8]
or eax, eax
je 0x43a359
mov dword [ebx], eax
add ebx, 4
jmp 0x43a331
call dword [esi + 0x3a0c8]
mov ebp, dword [esi + 0x3a0bc]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x21f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x43a393
sub esp, 0xffffff80
jmp fcn.0042c58f
Function at 0x4873e0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x64000]
push edi
or ebp, 0xffffffff
jmp 0x487402
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x487409
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4873f8
mov eax, 1
add ebx, ebx
jne 0x48741b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x48742c
jne 0x48744b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x48744b
dec eax
add ebx, ebx
jne 0x487438
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x487410
add ebx, ebx
jne 0x487447
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x48749d
xor ecx, ecx
sub eax, 3
jb 0x487463
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x4874d2
sar eax, 1
mov ebp, eax
jmp 0x48746e
add ebx, ebx
jne 0x48746e
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x48743c
inc ecx
add ebx, ebx
jne 0x48747c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x48743c
add ebx, ebx
jne 0x487489
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x48747e
jne 0x48749a
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x48747e
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x4874bc
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x4874ae
jmp 0x4873fe
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x4874bc
add edi, ecx
jmp 0x4873fe
pop esi
mov edi, esi
mov ecx, 0x1cdd
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x4874da
cmp byte [edi], 0xe
jne 0x4874da
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x4874df
lea edi, [esi + 0x85000]
mov eax, dword [edi]
or eax, eax
je 0x48754e
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x9b610]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x9b6b0]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x48750c
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x9b6b4]
or eax, eax
je 0x487548
mov dword [ebx], eax
add ebx, 4
jmp 0x487529
call dword [esi + 0x9b6c4]
mov ebp, dword [esi + 0x9b6b8]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x21f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x487582
sub esp, 0xffffff80
jmp 0x455a74
Function at 0x101b866a
Capabilities:
Resolve function by parsing pe exports

Disassembly:
pushal
lea esp, [esp + 0x34]
je 0x101cb4a5
stc
stc
sub al, 0x30
jmp 0x101cb1ba
cmp al, 9
pushal
lea esp, [esp + 0x20]
ja 0x1021ca23
pushal
mov byte [esp], 0x7c
imul edx, edx, 0xa
push eax
add edx, eax
mov word [esp + 4], 0xe804
mov word [esp + 4], 0x4251
pushal
mov byte [esp + 4], dl
lea esp, [esp + 0x44]
jmp fcn.101c7a14

Function at 0x101c6a76
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push dword [edi]
pop dword [esp]
test ch, 0xa8
cmp edi, ebx
push ebp
pushal
lea esp, [esp + 0x24]
ja 0x101cdd5d
and al, 0xe4
cmp ah, 0x7a
sub ebx, edi
btc edi, 0x1e
cmc
add ebx, esp
pushfd
shl di, 9
mov edi, ebx
and al, 0x91
mov al, 0x2e
stc
jmp 0x10223a7c
clc
jmp 0x101c883b
test al, 0x2f
sub edi, 4
bt di, cx
bt bp, 7
test cl, 0xdd
jmp 0x101c2e32

Function at 0x101cad4d
Capabilities:
Resolve function by parsing pe exports

Disassembly:
wait
mov ss, word [edi - 0xc3fc30d]
add esp, dword [esi - 0x75]
push ds
call fcn.101c1eb3
jnp 0x101c92a8
push 0xffffffffffffffbe
les ebp, [esi]
sbb dl, 0xd7
and esp, dword [eax]
daa
leave
push 0xc03dcab9
mov dl, 0x4c
lodsd eax, dword [esi]
add dl, byte [eax - 0x24]
pop edx
salc
fst st(4)
sal dword [edx], 1
test byte [eax], dl
pushfd
push ss
daa
pop eax
add dword [edx], esi
cwde
pop edx
cdq
mov ah, 0xc1
inc edx
invalid
mov dh, 0
push dword [esp]
jmp 0x101c92d8

Function at 0x101cbbb3
Capabilities:
Encode data using xor

Disassembly:
jb 0x1028b049
lea eax, [ecx*2 - 0x3ba6fb65]
not ah
xadd ah, dh
bt cx, di
mov eax, dword [ebp - 0x20]
setb dh
rcl dh, 1
not eax
shl cl, 6
xor dh, bh
sar dh, cl
rol dh, cl
mov cl, byte [eax + edi]
rcr dh, 3
movsx eax, cl
das
add cl, cl
call fcn.101b8d46
invalid
mov dword [esp], ebx
xchg dx, bx
bt ax, cx
bts ebx, 0x19
mov ebx, eax
shrd dx, cx, cl
sal dx, 0xe
or dl, bl
mov edx, 1
test al, ch
stc
cmp ecx, 7
jmp 0x101c3f91

Function at 0x101ccb8d
Capabilities:
Resolve function by parsing pe exports

Disassembly:
setg ah
xchg dword [esp + 0x38], edi
movzx ax, bl
call fcn.10294ab5

Function at 0x101cd02d
Capabilities:
Resolve function by parsing pe exports

Disassembly:
pushal
pushfd
dec al
pushal
mov ecx, edi
lea esp, [esp + 0x44]
call fcn.101c4e01
add byte [eax], al
dec esp
outsd dx, dword [esi]
arpl word [ecx + 0x6c], sp
inc esi
jb 0x101cd086
add byte gs:[edi + 0x6c], ch
xor esi, dword gs:[edx]
insb byte es:[edi], dx
insb byte es:[edi], dx
add byte [edi], cl
mov edx, 0x8b0f1df3
or byte [edi + edi*8 - 0x1c3e9901], ch
push cs
mov ebx, eax
test bh, cl
cmp byte [edi], 0x23
jmp 0x10221b7a
jmp dword [esi - 0x3f]
arpl word [ecx + 0x27], bp
push ebp
xor dword [ebx + 0x12], 0xde4e5128
nop
je 0x101cd036
mov al, 0x5c
leave
and al, ah
shr dword [ebp + 0x52f93ae7], 1
fcmovne st(0), st(2)
jmp 0x4d5e0bec
jne 0x101cb4ad
adc ax, bp
sub edx, edx
aaa
mov eax, edx
test dh, 0xb5
rol al, cl
dec al
call fcn.10227681
Function at 0x101cd9e8
Capabilities:
Resolve function by parsing pe exports

Disassembly:
lea eax, [edi + 0x6620207b]
mov eax, edx
mov word [esp], cx
pushfd
lea esp, [esp + 8]
jmp fcn.101c7a14
pushfd
mov byte [esp + 4], 0xd1
lea esp, [esp + 8]
jne 0x101cb4ad
push eax
rcr al, 7
neg ah
shl eax, 4
xor edx, edx
jmp 0x101cb5b7

Function at 0x101ce9b1
Capabilities:
Resolve function by parsing pe exports

Disassembly:
lea esp, [esp + 4]
je 0x1021e6a2
pushfd
cmp ebx, 3
jmp 0x1021d087
mov dword [esp], edx
call 0x101ca3de

Function at 0x102255c5
Capabilities:
Resolve function by parsing pe exports

Disassembly:
pushal
call fcn.10222275
mov dword [ebp - 4], ebx
shl cl, cl
lahf
mov eax, edx
not ch
btr ecx, esi
btr ecx, 5
shr eax, 0x10
lea esp, [esp + 8]
add edi, eax
bt dx, 3
bt bx, 7
cmp si, ax
pushfd
mov edi, dword [edi + ecx*4]
lea esp, [esp + 8]
ja 0x10221928
test bl, ch
test edi, edi
pushfd
mov dword [esp], edi
lea esp, [esp + 4]
je fcn.10220812
push 0x97b723db
test edi, 0xafa4524
add eax, edi
jmp 0x10288569

Function at 0x10227983
Capabilities:
Resolve function by parsing pe exports

Disassembly:
xchg di, cx
mov ch, 0xea
mov edi, edx
pushfd
lea esp, [esp + 4]
je 0x101cb4a5
call fcn.101c1d7c
push ebx
push edi
pushal
lea esp, [esp + 0x2c]
jne 0x101cb4ad
neg al
movzx ax, bl
sub edx, edx
bts ax, bx
mov eax, edx
shr al, 1
sal al, 1
shl al, cl
add edi, 1
or al, cl
xor al, 0x57
setle al
mov al, byte [edi]
cmp eax, 0x97fa5e0d
test al, al
jmp 0x101ccb9d