joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100129ec
Capabilities:
Enumerate processes

Disassembly:
push 0x238
mov eax, 0x1002cef1
call fcn.10014f28
mov ebx, dword [ebp + 8]
test ebx, ebx
jne 0x10012a09
xor eax, eax
jmp 0x10012adf
xor edi, edi
push edi
push 2
call sub.kernel32.dll_CreateToolhelp32Snapshot
mov esi, eax
test esi, esi
je 0x10012add
lea eax, [ebp - 0x23c]
mov dword [ebp - 0x23c], 0x22c
push eax
push esi
call sub.kernel32.dll_Process32FirstW
jmp 0x10012ab3
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x244]
call fcn.100125e1
push ebx
lea ecx, [ebp - 0x240]
mov dword [ebp - 4], edi
call fcn.100125e1
lea ecx, [ebp - 0x244]
mov byte [ebp - 4], 1
call fcn.10012b61
lea ecx, [ebp - 0x240]
call fcn.10012b61
push dword [ebp - 0x244]
lea ecx, [ebp - 0x240]
call main
mov ecx, dword [ebp - 0x240]
lea ecx, [ecx - 0x10]
test eax, eax
je 0x10012abd
call fcn.10012c52
mov ecx, dword [ebp - 0x244]
or dword [ebp - 4], 0xffffffff
lea ecx, [ecx - 0x10]
call fcn.10012c52
lea eax, [ebp - 0x23c]
push eax
push esi
call sub.kernel32.dll_Process32NextW
test eax, eax
jne 0x10012a36
jmp 0x10012ad6
mov edi, dword [ebp - 0x234]
call fcn.10012c52
mov ecx, dword [ebp - 0x244]
add ecx, 0xfffffff0
call fcn.10012c52
push esi
call dword [sym.imp.kernel32.dll_CloseHandle]
mov eax, edi
call fcn.10014ed2
ret

Function at 0x100298a4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
pushal
call 0x100298b3
pop dword [ebp - 0x50]
mov eax, 0x4e07ece9
sub eax, 0x3e055436
sub dword [ebp - 0x50], eax
push 0x40
push 0x1000
push 0x3da32
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x50]
call dword [eax]
mov ecx, 0x657a3019
sub ecx, 0x6579f220
xor esi, esi
add esi, eax
mov edi, 0x10049800
add edi, dword [ebp - 0x50]
mov edx, 0x58d0eea7
sub edx, 0x6c4ebeb2
xor dword [ebp - 0x1c], 0x4f328b6a
mov ebx, dword [edi]
sub dword [ebp - 0x1c], 0x72f59551
xor ebx, edx
add dword [ebp - 0x38], 0x81f0cf6b
mov dword [esi], ebx
add esi, 0xfed0c99
add esi, 0xf012f36b
add edi, 0x334d322c
add edi, 0xccb2cdd8
loop 0x10029909
add eax, 0xeab7
xor ebx, ebx
add ebx, eax
add eax, 0xd9dffcc1
add eax, 0x26200344
mov ecx, 0x150261a2
add ecx, 0xfafd9e5e
add ecx, dword [ebp - 0x50]
call ebx
leave
ret
Function at 0x10017e0b
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x10002c7c]
jne 0x10018dc2
ret
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x328
mov dword [0x1001fab0], eax
mov dword [0x1001faac], ecx
mov dword [0x1001faa8], edx
mov dword [0x1001faa4], ebx
mov dword [0x1001faa0], esi
mov dword [0x1001fa9c], edi
mov word [0x1001fac8], ss
mov word [0x1001fabc], cs
mov word [0x1001fa98], ds
mov word [0x1001fa94], es
mov word [0x1001fa90], fs
mov word [0x1001fa8c], gs
pushfd
pop dword [0x1001fac0]
mov eax, dword [ebp]
mov dword [0x1001fab4], eax
mov eax, dword [ebp + 4]
mov dword [0x1001fab8], eax
lea eax, [ebp + 8]
mov dword [0x1001fac4], eax
mov eax, dword [ebp - 0x320]
mov dword [0x1001fa00], 0x10001
mov eax, dword [0x1001fab8]
mov dword [0x1001f9b4], eax
mov dword [0x1001f9a8], 0xc0000409
mov dword [0x1001f9ac], 1
mov eax, dword [0x10002c7c]
mov dword [ebp - 0x328], eax
mov eax, dword [0x1001f67c]
mov dword [ebp - 0x324], eax
call dword [sym.imp.kernel32.dll_IsDebuggerPresent]
mov dword [0x1001f9f8], eax
push 1
call sub.MSVCR100.dll__crt_debugger_hook
pop ecx
push 0
call dword [sym.imp.kernel32.dll_SetUnhandledExceptionFilter]
push 0x10002e78
call dword [sym.imp.kernel32.dll_UnhandledExceptionFilter]
cmp dword [0x1001f9f8], 0
jne 0x10018eae
push 1
call sub.MSVCR100.dll__crt_debugger_hook
pop ecx
push 0xc0000409
call dword [sym.imp.kernel32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.kernel32.dll_TerminateProcess]
leave
ret

Function at 0x10019121
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
pushal
call 0x10019130
pop dword [ebp - 0x4c]
mov eax, 0xa46fec0
sub eax, 0xfa456d90
sub dword [ebp - 0x4c], eax
push 0x40
push 0x1000
push 0x3a9d8
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x4c]
call dword [eax]
mov ecx, 0xe553b642
add ecx, 0x1aac905d
xor esi, esi
add esi, eax
mov edi, 0x86183b71
sub edi, 0x7615f971
add edi, dword [ebp - 0x4c]
mov edx, 0x22d5814a
add edx, 0xad1532d9
mov dword [ebp - 0x40], 0xf6d7e178
mov ebx, dword [edi]
add dword [ebp - 0x18], edx
xor ebx, edx
mov dword [esi], ebx
xor dword [ebp - 0x18], edi
add esi, 0x85e6afd9
add esi, 0x7a19502b
add edi, 4
loop 0x1001918c
add eax, 0x10d4f
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x382cbd98
add ecx, 0xd7d34268
add ecx, dword [ebp - 0x4c]
call ebx
leave
ret
Function at 0x430005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
mov eax, section..text
push 4
nop
nop
nop
nop
nop
nop
nop
nop
nop
pop edi
nop
nop
cmp eax, 0
nop
nop
nop
je 0x430072
nop
nop
nop
mov ebx, 0x408e54
mov ecx, ebx
nop
nop
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x312e54c6
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
loop 0x430060
nop
nop
nop
nop
mov eax, section..data
nop
nop
nop
nop
cmp eax, 0
nop
je 0x4300d2
nop
nop
nop
nop
mov ebx, 0x42e1d0
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x49b01bfc
nop
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x4300c0
nop
nop
nop
nop
nop
nop
popal
jmp 0x401219
Function at 0x402706
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 0xc]
push esi
imul eax, eax, 0x61c88647
mov esi, dword [esp + 0xc]
test eax, eax
mov edx, dword [esi]
mov ecx, dword [esi + 4]
je 0x40276e
mov esi, dword [esp + 8]
push ebx
push edi
mov edi, edx
mov ebx, edx
sar edi, 5
shl ebx, 4
xor edi, ebx
mov ebx, eax
sar ebx, 0xb
and ebx, 3
add edi, dword [esi + ebx*4]
mov ebx, eax
xor ebx, edx
add eax, 0x61c88647
add edi, ebx
sub ecx, edi
mov edi, ecx
mov ebx, ecx
sar edi, 5
shl ebx, 4
xor edi, ebx
mov ebx, eax
and ebx, 3
add edi, dword [esi + ebx*4]
mov ebx, eax
xor ebx, ecx
add edi, ebx
sub edx, edi
test eax, eax
jne 0x402724
mov esi, dword [esp + 0x14]
pop edi
pop ebx
mov dword [esi], edx
mov dword [esi + 4], ecx
pop esi
ret

Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x407ef8
nop
mov ecx, 0x73ef54ca
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x42e04e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x42e024
nop
nop
nop
mov eax, section..data
mov ebx, 0x42cd70
nop
nop
mov ecx, 0x49162915
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x42e084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
add eax, 4
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
nop
jne 0x42e06c
nop
nop
nop
popal
nop
nop
jmp 0x401219
Function at 0x1000b7a1
Capabilities:
Print debug messages

Disassembly:
sub esp, 0x824
mov eax, dword [0x10041024]
xor eax, esp
mov dword [esp + 0x820], eax
push ebx
push ebp
mov ebp, dword [esp + 0x830]
lea eax, [esp + 0x428]
push esi
mov esi, dword [esp + 0x838]
xor ebx, ebx
push edi
mov edi, 0x400
push edi
push ebx
push eax
call fcn.1000de50
push esi
push ebx
push ebp
push 0xffffffffffffffff
lea eax, [esp + 0x44c]
push edi
push eax
call fcn.10018088
movzx ecx, byte [esp + 0x853]
lea edi, [esp + 0x34]
xor edx, edx
test eax, eax
push 8
cmovs ecx, edx
xor eax, eax
mov byte [esp + 0x857], cl
pop ecx
rep stosd dword es:[edi], eax
lea eax, [esp + 0x34]
push 0x20
push eax
call fcn.10018088
push 0x10038198
lea eax, [esp + 0x40]
push 0x20
push eax
call fcn.10018088
push 0x400
lea eax, [esp + 0x6c]
push ebx
push eax
call fcn.1000de50
mov ecx, ebp
add esp, 0x44
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1000b846
sub ecx, edx
cmp ecx, 6
jbe 0x1000b86d
lea eax, [ebp - 6]
add eax, ecx
push str.__08x_
push eax
call fcn.10018088
pop ecx
pop ecx
test eax, eax
jne 0x1000b86d
xor ebx, ebx
inc ebx
lea esi, [esp + 0x10]
lea ecx, [esi + 1]
mov al, byte [esi]
inc esi
test al, al
jne 0x1000b874
sub esi, ecx
lea eax, [esp + 0x430]
push eax
mov ecx, 0x10036ae3
test ebx, ebx
mov eax, str.Error:
cmove eax, ecx
push eax
call dword [sym.imp.kernel32.dll_GetCurrentThreadId]
push eax
call dword [sym.imp.kernel32.dll_GetCurrentProcessId]
push eax
push str.P:_04d_T:_04d__s_s
mov eax, 0x3ff
sub eax, esi
push 0xffffffffffffffff
push eax
lea eax, [esp + 0x4c]
add eax, esi
push eax
call fcn.10018088
mov ecx, dword [esp + 0x44b]
test eax, eax
push esi
lea eax, [esp + 0x34]
mov edx, 0x2e2e2e
push eax
lea eax, [esp + 0x58]
cmovs ecx, edx
push eax
mov dword [esp + 0x457], ecx
call fcn.1000d8d0
lea edi, [esp + 0x5c]
add esp, 0x2c
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x1000b8ee
mov ax, word [0x100381c4]
mov word [edi], ax
lea eax, [esp + 0x30]
push eax
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
mov ecx, dword [esp + 0x830]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.1000be90
add esp, 0x824
ret

Function at 0x10018088
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
pushal
call 0x10018097
pop dword [ebp - 0x10]
mov eax, 0xe40609be
sub eax, 0xd4048927
sub dword [ebp - 0x10], eax
push 0x40
push 0x1000
push 0x40579
push 0
mov eax, 0x103dd820
sub eax, 0x3b168c
add eax, dword [ebp - 0x10]
call dword [eax]
mov ecx, 0xe22e10df
add ecx, 0x1dd23a38
mov edi, eax
mov edx, 0x5d9e66d1
add edx, 0xb265f92f
add edx, dword [ebp - 0x10]
mov esi, 0x44ae8d87
add dword [ebp - 8], 0x139256ed
mov ebx, dword [edx]
add dword [ebp - 0xc], 0x3be4aa17
xor ebx, esi
mov dword [edi], ebx
sub dword [ebp - 8], 0x3ba2890a
add edi, 0x6bfc1458
sub edi, 0x6bfc1454
add edx, 4
loop 0x100180f0
add eax, 0x81519d2a
add eax, 0x7eaf8205
mov ebx, eax
add eax, 0x302f0c8e
add eax, 0xcfd0f377
mov ecx, 0x6d2f4f37
sub ecx, 0x5d2f4f37
add ecx, dword [ebp - 0x10]
call ebx
leave
ret
Function at 0x1000783d
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push 0x24
push 0x10041c30
call fcn.10009a30
mov dword [ebp - 0x30], edx
mov ebx, ecx
xor esi, esi
test ebx, ebx
jne 0x1000785d
push esi
call dword [sym.imp.kernel32.dll_GetModuleHandleW]
mov ebx, eax
mov dword [ebp - 4], esi
mov eax, 0x5a4d
cmp word [ebx], ax
je 0x10007874
push 0xc1
jmp 0x10007985
mov edi, dword [ebx + 0x3c]
cmp dword [edi + ebx], 0x4550
je 0x1000788a
push 0xbf
jmp 0x10007985
cmp word [edi + ebx + 0x14], si
je 0x10007980
mov edi, dword [edi + ebx + 0x78]
lea eax, [edi + ebx]
neg edi
sbb edi, edi
and edi, eax
mov dword [ebp - 0x28], edi
je 0x10007980
mov ecx, dword [edi + 0x1c]
lea eax, [ecx + ebx]
neg ecx
sbb ecx, ecx
and ecx, eax
mov dword [ebp - 0x34], ecx
mov edx, dword [edi + 0x20]
lea eax, [edx + ebx]
neg edx
sbb edx, edx
and edx, eax
mov dword [ebp - 0x2c], edx
mov edx, dword [edi + 0x24]
lea eax, [edx + ebx]
neg edx
sbb edx, edx
and edx, eax
mov dword [ebp - 0x24], edx
mov eax, esi
mov dword [ebp - 0x1c], esi
cmp eax, dword [edi + 0x14]
jae 0x10007957
test ecx, ecx
je 0x100078f4
mov edx, dword [ecx + eax*4]
lea eax, [edx + ebx]
neg edx
sbb edx, edx
and edx, eax
jmp 0x100078f6
mov edx, esi
mov ecx, esi
mov eax, esi
mov dword [ebp - 0x20], esi
cmp eax, dword [edi + 0x18]
jae 0x10007927
mov edi, dword [ebp - 0x24]
movzx eax, word [edi + eax*2]
cmp eax, dword [ebp - 0x1c]
mov edi, dword [ebp - 0x28]
jne 0x1000794e
mov eax, dword [ebp - 0x2c]
test eax, eax
je 0x1000794a
mov ecx, dword [ebp - 0x20]
mov ecx, dword [eax + ecx*4]
lea eax, [ecx + ebx]
neg ecx
sbb ecx, ecx
and ecx, eax
mov eax, dword [edi + 0x10]
add eax, dword [ebp - 0x1c]
push edx
push ecx
push eax
push dword [ebp - 0x30]
mov eax, 0x10006382
call eax
test eax, eax
je 0x10007957
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x34]
jmp 0x100078dd
mov ecx, esi
jmp 0x10007927
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
jmp 0x100078fd
push esi
call dword [sym.imp.kernel32.dll_SetLastError]
mov dword [ebp - 4], 0xfffffffe
xor eax, eax
inc eax
jmp 0x10007994
push 0xc0
call dword [sym.imp.kernel32.dll_SetLastError]
mov dword [ebp - 4], 0xfffffffe
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x10010ea0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
pushal
call 0x10010eaf
pop dword [ebp - 0x44]
mov eax, 0x10010eaf
sub dword [ebp - 0x44], eax
push 0x40
push 0x1000
push 0x40f08
push 0
mov eax, 0x8f2e7b50
add eax, 0x80d4b504
add eax, dword [ebp - 0x44]
call dword [eax]
mov ecx, 0x3c27
mov esi, eax
mov edi, 0x5fd95132
sub edi, 0x4fd49b32
add edi, dword [ebp - 0x44]
mov edx, 0x1eb408c5
sub dword [ebp - 0x1c], eax
mov ebx, dword [edi]
xor dword [ebp - 0x1c], 0xbd5461fe
xor ebx, edx
sub dword [ebp - 0x10], 0xb6bc28a2
mov dword [esi], ebx
xor dword [ebp - 0x24], 0xe2fc090f
add esi, 0x7ca27b6b
add esi, 0x835d8499
add edi, 4
loop 0x10010efd
add eax, 0xe36f
mov ebx, eax
add eax, 0xedafcd58
add eax, 0x125032ad
mov ecx, 0x5d317454
add ecx, 0xb2ce8bac
add ecx, dword [ebp - 0x44]
call ebx
leave
ret
Function at 0x440130
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.tJrdyPER
lea edi, [esi - 0x13000]
push edi
or ebp, 0xffffffff
jmp 0x440152
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x440159
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x440148
nop
push 1
nop
pop eax
add ebx, ebx
jne 0x44016b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x440160
jne 0x44017c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x440160
xor ecx, ecx
sub eax, 3
jb 0x440190
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x440202
mov ebp, eax
add ebx, ebx
jne 0x44019b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x4401a8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x4401cc
inc ecx
add ebx, ebx
jne 0x4401b8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x4401ad
jne 0x4401c9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4401ad
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x4401ec
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x4401dd
jmp 0x44014e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x4401ec
add edi, ecx
jmp 0x44014e
pop esi
lea edi, [esi + 0x3e000]
mov eax, dword [edi]
or eax, eax
je 0x440254
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x4020c]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x402b4]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x440209
push edi
pop ecx
jns 0x440238
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x402bc]
or eax, eax
je 0x44024e
mov dword [ebx], eax
add ebx, 4
jmp 0x440226
call dword [esi + 0x402b8]
mov ebp, dword [esi + 0x402c0]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1f7]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x440288
sub esp, 0xffffff80
jmp section.NDltoTPW

Function at 0x433001
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x40de38
mov ecx, 0x30ca6585
nop
nop
nop
nop
nop
test eax, eax
nop
nop
je 0x43304e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x433024
nop
nop
mov eax, section..data
nop
mov ebx, 0x4304d8
nop
mov ecx, 0x5f223de0
test eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
je 0x433084
nop
nop
xor dword [eax], ecx
nop
nop
add eax, 4
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x43306c
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0x4207f0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x15000]
push edi
or ebp, 0xffffffff
jmp 0x420812
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x420819
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x420808
mov eax, 1
add ebx, ebx
jne 0x42082b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x420820
jne 0x42083c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x420820
xor ecx, ecx
sub eax, 3
jb 0x420850
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x4208c2
mov ebp, eax
add ebx, ebx
jne 0x42085b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x420868
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x42088c
inc ecx
add ebx, ebx
jne 0x420878
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x42086d
jne 0x420889
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x42086d
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x4208ac
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x42089d
jmp 0x42080e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x4208ac
add edi, ecx
jmp 0x42080e
pop esi
mov edi, esi
mov ecx, 0x810
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x4208ca
cmp byte [edi], 0xd
jne 0x4208ca
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov eax, ebx
loop 0x4208cf
lea edi, [esi + 0x1e000]
mov eax, dword [edi]
or eax, eax
je 0x420947
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x2193c]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x219f0]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x4208fc
mov ecx, edi
jns 0x42092b
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x219f4]
or eax, eax
je 0x420941
mov dword [ebx], eax
add ebx, 4
jmp 0x420919
call dword [esi + 0x219f8]
popal
jmp section.UPX0

Function at 0x430003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
call 0x43000c
pop eax
nop
nop
nop
nop
nop
add eax, 0x403d6f
nop
nop
sub eax, 0x403d15
nop
nop
nop
mov ebx, dword [eax]
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
xor dword [ebx], edx
nop
nop
nop
nop
nop
nop
nop
add ebx, 4
nop
cmp ebx, ecx
nop
nop
nop
jl 0x430030
nop
nop
nop
nop
nop
nop
nop
add eax, 0xc
cmp dword [eax], 0
nop
nop
nop
nop
nop
nop
jne 0x43001e
nop
nop
nop
popal
nop
nop
nop
jmp int.00401219
Function at 0x5911b9
Capabilities:
Enumerate pe sections
Inspect section memory permissions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [ebp + 8]
and dword [ebp - 0x14], 0
push ebx
push esi
mov esi, dword [eax + 0x3c]
add esi, eax
mov eax, dword [esi + 0x50]
mov ebx, dword [esi + 0x34]
mov dword [ebp - 0xc], eax
mov eax, dword [esi + 0x28]
push edi
mov edi, dword [esi + 0x54]
mov dword [ebp - 0x20], eax
push 1
push 0x2000
push dword [ebp - 0xc]
push ebx
call dword [ebp + 0xc]
add ebx, 0x10000
test eax, eax
mov dword [ebp - 4], eax
je 0x5911e0
push 4
push 0x1000
push edi
push eax
call dword [ebp + 0xc]
test edi, edi
jbe 0x591220
mov edx, dword [ebp + 8]
mov ecx, eax
sub edx, eax
mov dword [ebp - 0xc], edi
mov bl, byte [edx + ecx]
mov byte [ecx], bl
inc ecx
dec dword [ebp - 0xc]
jne 0x591215
lea ecx, [ebp - 0x1c]
push ecx
push 2
push edi
push eax
call dword [ebp + 0x10]
movzx eax, word [esi + 0x14]
and dword [ebp - 0xc], 0
cmp word [esi + 6], 0
lea edi, [eax + esi + 0x18]
mov dword [ebp - 0x18], edi
jbe 0x59129e
add edi, 8
mov eax, dword [edi]
mov ecx, dword [edi + 8]
cmp ecx, eax
mov dword [ebp - 8], eax
ja 0x591253
mov dword [ebp - 8], ecx
push 4
push 0x1000
push eax
mov eax, dword [edi + 4]
add eax, dword [ebp - 4]
push eax
call dword [ebp + 0xc]
xor ecx, ecx
cmp dword [edi], ecx
jbe 0x591274
mov byte [ecx + eax], 0
inc ecx
cmp ecx, dword [edi]
jb 0x59126b
xor ecx, ecx
cmp dword [ebp - 8], ecx
jbe 0x59128f
mov edx, dword [edi + 0xc]
mov ebx, dword [ebp + 8]
add edx, ecx
mov dl, byte [edx + ebx]
mov byte [ecx + eax], dl
inc ecx
cmp ecx, dword [ebp - 8]
jb 0x59127b
movzx eax, word [esi + 6]
add edi, 0x28
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], eax
jl 0x591244
mov eax, dword [ebp - 4]
sub eax, dword [esi + 0x34]
and dword [ebp - 0xc], 0
lea ecx, [esi + 0xa0]
mov edx, dword [ecx + 4]
mov dword [ebp - 0x10], eax
mov eax, dword [ecx]
add eax, dword [ebp - 4]
add edx, eax
cmp eax, edx
mov dword [ebp + 8], edx
jae 0x591340
Function at 0x5912e0
Capabilities:
Inspect section memory permissions

Disassembly:
mov edi, dword [eax + 4]
test edi, edi
jbe 0x591340
mov ecx, dword [eax]
add ecx, dword [ebp - 4]
and dword [ebp + 0xc], 0
add edi, 0xfffffff8
shr edi, 1
test edi, edi
lea ebx, [eax + 8]
jbe 0x591332
movzx edx, word [ebx]
and edx, 0xfff
movsx eax, dx
movzx edx, word [ebx]
adc eax, dword [ecx + 0xfffe2]
add byte [edi], cl
mov edi, 0x13b70fc2
movzx edx, dx
shr edx, 0xc
add eax, ecx
sub edx, 0
je 0x591322
dec edx
je 0x591313
dec edx
je 0x59130a
dec edx
jne 0x59132f
mov edx, dword [ebp - 0x10]
add dword [eax], edx
jmp 0x591322
mov dx, word [ebp - 0x10]
add word [eax], dx
jmp 0x591322
movzx edx, word [eax]
shl edx, 0x10
add edx, dword [ebp - 0x10]
shr edx, 0x10
mov word [eax], dx
inc ebx
inc ebx
inc dword [ebp + 0xc]
movzx eax, word [ebp + 0xc]
cmp eax, edi
jb 0x5912de
mov edx, dword [ebp + 8]
test ebx, ebx
mov eax, ebx
je 0x591440
cmp ebx, edx
jb 0x5912c2
mov ebx, dword [esi + 0x80]
mov edi, dword [ebp - 4]
add ebx, edi
jmp 0x591398
add eax, edi
push eax
call dword [ebp + 0x18]
test eax, eax
mov dword [ebp + 0xc], eax
je 0x591440
cmp dword [ebx + 4], 0
jne 0x591369
mov edi, dword [ebx + 0x10]
jmp 0x59136b
mov edi, dword [ebx]
add edi, dword [ebp - 4]
jmp 0x59138d
mov eax, dword [edi]
test eax, eax
jns 0x59137a
push 1
jmp 0x591382
mov ecx, dword [ebp - 4]
lea eax, [eax + ecx + 2]
push eax
push dword [ebp + 0xc]
call dword [ebp + 0x1c]
mov dword [edi], eax
add edi, 4
cmp dword [edi], 0
jne 0x591370
mov edi, dword [ebp - 4]
add ebx, 0x14
mov eax, dword [ebx + 0xc]
test eax, eax
jne 0x59134d
and dword [ebp + 0xc], eax
cmp word [esi + 6], ax
jbe 0x591430
mov ebx, dword [ebp - 0x18]
add ebx, 8
mov eax, dword [ebx + 0x1c]
xor ecx, ecx
test eax, 0x4000000
je 0x5913c3
mov ecx, 0x200
test eax, 0x20000000
je 0x5913f0
test eax, 0x40000000
je 0x5913df
test eax, eax
jns 0x5913da
or ecx, 0x40
jmp 0x591411
or ecx, 0x20
jmp 0x591411
test eax, eax
jns 0x5913eb
or ecx, 0x80
jmp 0x591411
or ecx, 0x10
jmp 0x591411
test eax, 0x40000000
je 0x591405
test eax, eax
jns 0x591400
or ecx, 4
jmp 0x591411
or ecx, 2
jmp 0x591411
test eax, eax
js 0x59140e
or ecx, 8
jmp 0x591411
or ecx, 1
lea eax, [ebp - 0x1c]
push eax
mov eax, dword [ebx + 4]
push ecx
push dword [ebx]
add eax, edi
push eax
call dword [ebp + 0x10]
movzx eax, word [esi + 6]
inc dword [ebp + 0xc]
add ebx, 0x28
cmp dword [ebp + 0xc], eax
jl 0x5913b2
push dword [ebp + 0x20]
mov eax, dword [ebp - 0x20]
push 1
push edi
add eax, edi
call eax
mov dword [ebp - 0x14], edi
mov eax, dword [ebp - 0x14]
pop edi
pop esi
pop ebx
leave
ret 0x1c