joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46cdf8
Capabilities:
Check os version

Disassembly:
add esp, 0xffffff6c
mov dword [esp], 0x94
push esp
call sub.kernel32.dll_GetVersionExA
cmp dword [esp + 4], 6
setae al
add esp, 0x94
ret

Function at 0x47b00c
Capabilities:
Hash data with md5

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
xor ecx, ecx
mov edx, 0x58
call fcn.00403444
mov dword [ebx], 0x67452301
mov dword [ebx + 4], 0xefcdab89
mov dword [ebx + 8], 0x98badcfe
mov dword [ebx + 0xc], 0x10325476
pop ebx
ret
Function at 0x1feb1650
Capabilities:
Get thread local storage value

Disassembly:
sub esp, 0x4e4
mov eax, dword [0x1feb903c]
push ebx
push esi
push edi
push ebp
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
jne 0x1feb1682
push 0
call fcn.1feb4540
add esp, 4
test eax, eax
jne 0x1feb1682
mov dword [esp + 0x34], 0x1feba2e0
jmp 0x1feb1692
mov eax, dword [0x1feb903c]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [esp + 0x34], eax
mov ecx, dword [esp + 0x4f8]
mov dword [esp + 0x6c], 0
mov eax, dword [ecx + 4]
mov dword [esp + 0x28], 1
mov ebp, dword [eax + 0x30]
mov esi, dword [eax + 0x10]
call fcn.1feb45d0
lea edi, [esp + 0xf4]
xor eax, eax
mov ecx, 0x100
rep stosd dword es:[edi], eax
dec esi
cmp esi, 0x1f
ja 0x1feb16da
mov al, byte [esi + 0x1feb2944]
jmp dword [eax*4 + 0x1feb2928]
mov eax, 0xffffffe5
jmp 0x1feb291a
invalid
Function at 0x1feb2aa0
Capabilities:
Inspect section memory permissions

Disassembly:
cmp dword [eax], ebx
je 0x1feb2aca
mov edx, dword [eax + 4]
lea ecx, [eax + 8]
add edx, eax
mov dword [ebp + 8], ecx
cmp ecx, edx
jae 0x1feb2ac5
mov ecx, dword [ebp + 8]
movzx ecx, word [ecx]
mov edx, ecx
and edx, 0xf000
cmp edx, 0x3000
jne 0x1feb2aaf
and ecx, 0xfff
add byte [eax], al
mov edx, esi
sub edx, dword [edi + 0x34]
add ecx, esi
add ecx, dword [eax]
add dword [ecx], edx
jmp 0x1feb2ab7
cmp edx, ebx
jne 0x1feb2c05
mov ecx, dword [eax + 4]
add dword [ebp + 8], 2
add ecx, eax
cmp dword [ebp + 8], ecx
jb 0x1feb2a86
add eax, dword [eax + 4]
jmp 0x1feb2a73
mov dword [ebp + 0xc], ebx
jmp 0x1feb2ad5
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x1feb2aed
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp 0x1feb2b0b
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
mov edx, dword [edi + eax*8 + 0x108]
lea eax, [edi + eax*8 + 0xf8]
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
mov dword [ebp - 0x44], eax
mov eax, ecx
div dword [ebp - 0xac]
cmp eax, dword [ebp - 0x44]
ja 0x1feb2b69
mov edx, edi
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
mov dword [ebp + 0x10], edi
and edx, 0x20000000
and dword [ebp + 0x10], 0x80000000
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x1feb2b50
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x1feb2b59
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je 0x1feb2b63
add ecx, eax
or byte [ecx], 4
inc eax
cmp eax, dword [ebp - 0x44]
jbe 0x1feb2b45
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp + 0xc]
cmp cx, word [eax + 6]
jbe 0x1feb2acf
mov dword [ebp + 8], esi
xor edi, edi
mov eax, dword [ebp + 0x18]
push 2
pop ecx
movzx eax, byte [edi + eax]
sub eax, ecx
je 0x1feb2bb6
dec eax
je 0x1feb2bad
sub eax, 3
je 0x1feb2ba4
mov dword [ebp - 4], 0x40
jmp 0x1feb2bd3
mov dword [ebp - 4], 4
jmp 0x1feb2bb9
mov dword [ebp - 4], 0x20
jmp 0x1feb2bb9
mov dword [ebp - 4], ecx
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push dword [ebp - 0xac]
push dword [ebp + 8]
call dword [ebp - 0xbc]
test eax, eax
je 0x1feb2c05
mov eax, dword [ebp - 0xac]
add dword [ebp + 8], eax
inc edi
cmp edi, dword [ebp - 0x8c]
jbe 0x1feb2b85
mov eax, dword [ebp - 0x88]
mov edi, dword [eax + 0x28]
add edi, esi
call fcn.1feb2416
adc dword [edi + 0x75ff9351], edx
adc al, 0x6a
add dword [esi - 1], edx
xlatb
mov eax, esi
jmp 0x1feb2c11
push 0x8000
push ebx
push esi
call dword [ebp - 8]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x1feb45d0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sbb al, 0xad
cmp byte [eax + 0x1c], 0x18
je 0x1feb45da
xchg esi, eax
lodsd eax, dword [esi]
mov eax, dword [eax + 8]
push eax
call fcn.1feb2416
dec dword [esi - 0x74cd052e]
clc
mov eax, dword [edi + 0x3c]
Function at 0x44b610
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub esp, 8
mov cl, byte [0x65f042]
mov al, byte [0x65f041]
or cl, 0x10
push ebx
shr cl, 3
and ecx, 0xff
mov bl, byte [0x65f04b]
mov dword [esp + 4], ecx
xor bl, al
fild dword [esp + 4]
mov byte [0x65f04b], bl
mov ebx, dword [esp + 0x10]
test ebx, ebx
fdivr qword [0x6629a0]
push esi
fadd qword [0x65f058]
fstp qword [0x662a10]
je 0x44b6ce
push 0x65f0a4
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov edx, dword [0x65f030]
mov ecx, dword [0x65f034]
mov esi, eax
mov dword [esp + 0xc], 0
lea eax, [edx + edx]
or eax, ecx
mov dword [esp + 8], eax
fild qword [esp + 8]
test esi, esi
fadd qword [0x65f058]
fstp qword [0x65f058]
je 0x44b6ce
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x65f07c
push esi
call edi
push 0x65f064
push esi
call edi
xor eax, eax
pop edi
mov ecx, dword [esp + 0x14]
test ecx, ecx
je 0x44b6ce
lea ecx, [esp + 0x14]
inc eax
add ecx, 4
cmp eax, 0x36
jae 0x44b6d8
cmp dword [ecx], 0
jne 0x44b6c0
pop esi
xor al, al
pop ebx
add esp, 8
ret 4
mov dword [ebx], esi
pop esi
mov al, 1
pop ebx
add esp, 8
ret 4

Function at 0x4a9e85
Capabilities:
Encode data using xor

Disassembly:
ljmp 0xc2eb:0x9288b69a
stosd dword es:[edi], eax
test byte [esi], 0x93
outsd dx, dword [esi]
stc
enter 0x5bc9, 0x46
scasb al, byte es:[edi]
mov ebx, 0xdc808ae5
jo 0x4a9e7d
cmc
and ah, ch
push ss
out 0x72, al
and byte [ecx + 0x34], dh
mov cs, word [eax]
add ch, byte [esi + 0x36bf81a5]
cmp ecx, dword [edi]
xor byte [ebx], bh
rcl dword [edi + 0x3afe0ab3], cl
cwde
push es
add eax, 0xe45f7524
aaa
xor ah, cl
sbb ebx, dword [ebp + 0x6e28e34f]
salc
jg 0x4a9e99
and eax, dword [edi + 0x594e505f]
into
invalid

Function at 0x574d5d
Capabilities:
Encode data using xor

Disassembly:
rol byte [esi + 0x4456cb71], 1
js 0x574d84
dec ebp
push edx
xor al, 0xc1
sub byte [ebx + 0x39], ch
inc ebx
mov dl, 0xdf
jne 0x574d8d
cmpsb byte [esi], byte es:[edi]
int1
stosd dword es:[edi], eax
add dword [esi], eax
jle 0x574d81
test dword [esi - 0x4736a1f5], edi
push ebp
pop ecx
test eax, 0xb17ef51
popal
aad 0x60
pushal
push edi
ret 0x51e
push ds
add eax, 0xc06c92a1
dec edi
loopne 0x574d28
stc
fst dword [esi + 0x4c1678a6]
rcl byte [ebp + esi*2 - 0x355adb0e], cl
or al, dh
sbb esp, eax
xor byte [esi + 0x1009738b], bl
mov eax, 0xf50f0e36
adc eax, 0x368906e5
or al, 0x8d
mov eax, dword [0x4502c4b5]
jno 0x574d57
mov eax, dword gs:[0x4e661745]
Function at 0x5fe9e7
Capabilities:
Encode data using xor

Disassembly:
and al, 0x6e
aad 0xec
sar byte [esi - 0x2f], 7
adc al, 0x94
mov bl, byte [eax - 0x5b]
mov dh, 0xf8
inc esi
lahf
push 0x65e488da
xchg edi, eax
xchg edi, eax
or byte [esi], ah
fcomp dword [esi + 0x9f18088]
mov ebx, 0xe10591dc
sahf
mov byte [eax - 0x2344f60f], al
xchg ecx, eax
add eax, 0x80fab7e1
out 0xe4, al
mov bh, 0xfa
and dh, 0xe4
xor al, 0x82
movsb byte es:[edi], byte [esi]
sti
jb 0x5fe9f6
jbe 0x5fe9d2
pop ebp
add eax, 0x61b401d5
out 0, al
std
mov ebx, 0xa8d88537
push edi
les edi, [si]
out 0x44, eax
xchg ecx, eax
mov bh, 0xb4
add edx, dword [edi - 0x70]
das
cmp ecx, dword [ebx - 0x35553387]
lea eax, [ebp + 0x54]
jge 0x5fe9ec
mov edi, dword [ecx - 0x34]
stosb byte es:[edi], al
retf 0x458d
lodsd eax, dword [esi]
stosb byte es:[edi], al
mov esi, 0x188e36c5
jnp 0x5fea1f
pushal
invalid

Function at 0x6183e1
Capabilities:
Encode data using xor

Disassembly:
test al, 0x1d
int 0xf9
leave
mov byte [ecx], ah
or al, 0xc4
xlatb
sar dword [edx], 0x40
nop
aas
jecxz 0x618418
retf
lodsd eax, dword [esi]
add byte [eax], 0x5d
jo 0x618465
out 0x8d, al
mov ebx, 0xe3257a88
jl 0x6183b9
movsd dword es:[edi], dword [esi]
cdq
push es
pop edx
jecxz 0x618437
add al, 0xbc
inc ecx
mov bl, 0xa1
dec eax
inc byte [eax + 0x6d]
push ecx
xor byte [0xe03cb36f], bl
jmp 0x454fe3e7
jae 0x618458
movsd dword es:[edi], dword [esi]
mov eax, dword [0xa580c917]
insb byte es:[edi], dx
fsubr dword [ebx - 0x74]
adc byte [eax + ebx], 0x1f
leave
and byte [ebp - 0x73942794], 0x80
adc al, 0x18
pop ds
pop esp
jge 0x618496
dec esi
rcl byte [ebx - 0xa], 0xf4
adc al, 0x99
mov eax, dword [0xd02ae05d]
popfd
mov al, 0xbf
or eax, 0x90ac1f0c
pop ds
lodsb al, byte [esi]
nop
push ebp
xor bh, 0x31
jmp 0x618413
push ds
or byte [ebx], 0x80
mov dword [0xfb11e652], eax
or eax, dword [eax + 0x11e652a3]
sti
sbb byte [ebx], bh
xor al, 0x3f
out dx, al
outsb dx, byte [esi]
or dword [ebx + 0x16], ebx
pop esp
mov eax, 0xf151e7ea
test byte [eax + 0xc], dl
jp 0x61845a
push esp
jge 0x61847f
mov eax, 0xb0dbd56e
push ecx
dec eax
or dword [ecx + 0x50], 0x13
salc
mov eax, 0x61150280
loop 0x6184e0
add dl, byte [0x9655e261]
xchg esi, eax
sub eax, 0x26a09f2c
or byte [ebx - 0x21c4a645], ah
loopne 0x618460
fsubrp st(0)
invalid
arpl word [edi - 0x1db60f4e], di
pushal
sbb eax, 0x29000da3
wait
popfd
out dx, al
jle 0x618486
dec ebp
stosd dword es:[edi], eax
dec ebp
imul byte [edx - 0x40]
mov ebp, 0x2b7189b3
lea ebp, [ebx + edx + 0x750833d9]
cmp eax, 0x6d4b2fc1
lodsd eax, dword [esi]
ret
retf 0xff4b
Function at 0x65793d
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x65f3e8
cmp edx, dword [eax]
je 0x65795f
add eax, 8
inc ecx
cmp eax, 0x65f478
jl 0x657950
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x65f3e8]
jne 0x657a8d
mov eax, dword [0xa5bdc4]
cmp eax, 1
je 0x657a67
test eax, eax
jne 0x657990
cmp dword [0x65f314], 1
je 0x657a67
cmp edx, 0xfc
je 0x657a8d
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x6579c7
lea eax, [ebp - 0x1a4]
push 0x65ca38
push eax
call fcn.00658320
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.006587b0
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x657a0a
lea eax, [ebp - 0x1a4]
push eax
call fcn.006587b0
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x65ca34
push edi
call fcn.0065a680
add esp, 0x10
lea eax, [ebp - 0xa0]
push 0x65ca18
push eax
call fcn.00658320
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.00658330
lea eax, [ebp - 0xa0]
push 0x65ca14
push eax
call fcn.00658330
push dword [esi + 0x65f3ec]
lea eax, [ebp - 0xa0]
push eax
call fcn.00658330
push 0x12010
lea eax, [ebp - 0xa0]
push 0x65c9ec
push eax
call fcn.0065a5f4
add esp, 0x2c
pop edi
jmp 0x657a8d
lea eax, [ebp + 8]
lea esi, [esi + 0x65f3ec]
push 0
push eax
push dword [esi]
call fcn.006587b0
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x407d9c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004033fc
xor eax, eax
push ebp
push 0x407e75
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp byte [eax], 0x5c
jne 0x407dd4
mov eax, dword [ebp - 4]
call fcn.004071d0
jmp 0x407ddc
mov eax, dword [ebp - 4]
call fcn.00407bd4
call fcn.00404ae8
mov esi, eax
test esi, esi
jle 0x407e28
mov ebx, 1
lea edx, [ebp - 8]
mov eax, ebx
call fcn.004049d0
mov eax, dword [ebp - 8]
cmp byte [eax], 0x5c
jne 0x407e12
lea edx, [ebp - 0xc]
mov eax, ebx
call fcn.004049d0
mov eax, dword [ebp - 0xc]
call fcn.004071d0
jmp 0x407e24
lea edx, [ebp - 0x10]
mov eax, ebx
call fcn.004049d0
mov eax, dword [ebp - 0x10]
call fcn.00407bd4
inc ebx
dec esi
jne 0x407dec
push 1
push dword [ebp - 4]
push 0x407e8c
lea edx, [ebp - 0x18]
xor eax, eax
call fcn.00406f34
push dword [ebp - 0x18]
lea eax, [ebp - 0x14]
mov edx, 3
call fcn.004032cc
mov eax, dword [ebp - 0x14]
call fcn.0040340c
push eax
call sub.kernel32.dll_WinExec
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x407e7c
lea eax, [ebp - 0x18]
mov edx, 6
call fcn.004030b8
ret

Function at 0x433001
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
call 0x43300c
nop
nop
nop
nop
pop eax
nop
nop
add eax, 0x40a063
sub eax, 0x40a009
nop
nop
nop
nop
nop
mov ebx, dword [eax]
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
jl 0x433030
nop
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
jne 0x43301e
nop
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x431219
Function at 0x420a70
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x420a76
ret

Function at 0x4591fc
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x4eb008], 0x8088405
inc edx
mov dword [ebx + 0x4eb008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x459218
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x4eb008], 0x8088405
inc edx
mov dword [ebx + 0x4eb008], edx
fld qword [ebx + 0x4eb06c]
push 0
push edx
fild qword [esp]
add esp, 8
fmulp st(1)
pop ebx
ret

Function at 0x476670
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x476676
ret
Function at 0x4b0998
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
call fcn.0045ad84
xor eax, eax
push ebp
push 0x45af2a
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
call fcn.0045a8d4
mov ebx, 1
xor edi, edi
mov eax, dword [ebp - 4]
call fcn.0045ab94
mov dword [ebp - 0x18], eax
cmp ebx, dword [ebp - 0x18]
jg 0x4b0b07
jmp 0x4b0a6a
mov eax, dword [ebp - 4]
mov al, byte [eax + ebx - 1]
mov byte [ebp - 9], al
xor eax, eax
mov al, byte [ebp - 9]
cmp eax, 0x3d
jg 0x4b0a15
je 0x4b0a3d
sub eax, 0x2b
je 0x4b0a27
sub eax, 4
je 0x4b0a2d
dec eax
sub eax, 0xa
jb 0x4b0a33
jmp 0x4b0a56
add eax, 0xffffffbf
sub eax, 0x1a
jb 0x4b0a42
add eax, 0xfffffffa
sub eax, 0x1a
jb 0x4b0a4c
jmp 0x4b0a56
mov si, 0x3e
jmp 0x4b0a5a
mov si, 0x3f
jmp 0x4b0a5a
movzx esi, byte [ebp - 9]
sub si, 0xfffc
jmp 0x4b0a5a
or esi, 0xffffffff
jmp 0x4b0a5a
movzx esi, byte [ebp - 9]
sub si, 0x41
jmp 0x4b0a5a
movzx esi, byte [ebp - 9]
sub si, 0x47
jmp 0x4b0a5a
mov si, 0xfffe
cmp si, 0xfffe
je 0x4b0a69
movzx eax, di
mov word [ebp + eax*2 - 0x12], si
inc edi
inc ebx
cmp ebx, dword [ebp - 0x18]
jg 0x4b0a79
cmp di, 4
jb 0x4b09ed
cmp di, 4
jne 0x4b0afe
xor edi, edi
lea eax, [ebp - 0x1c]
mov dx, word [ebp - 0x12]
shl edx, 2
movsx ecx, word [ebp - 0x10]
shr ecx, 4
or dl, cl
call fcn.0045aabc
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 8]
call fcn.0045ab9c
mov eax, dword [ebp - 8]
cmp word [ebp - 0xe], 0xffff
je 0x4b0b07
lea eax, [ebp - 0x20]
mov dx, word [ebp - 0x10]
shl edx, 4
movsx ecx, word [ebp - 0xe]
shr ecx, 2
or dl, cl
call fcn.0045aabc
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 8]
call fcn.0045ab9c
mov eax, dword [ebp - 8]
cmp word [ebp - 0xc], 0xffff
je 0x4b0b07
lea eax, [ebp - 0x24]
mov dx, word [ebp - 0xe]
shl edx, 6
mov cx, word [ebp - 0xc]
or dl, cl
call fcn.0045aabc
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 8]
call fcn.0045ab9c
mov eax, dword [ebp - 8]
cmp ebx, dword [ebp - 0x18]
jle 0x4b0a6a
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45af31
lea eax, [ebp - 0x24]
mov edx, 3
call fcn.0045a8f8
lea eax, [ebp - 4]
call fcn.0045a8d4
ret
Function at 0x4d0250
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
mov ebx, eax
xor eax, eax
push ebp
push 0x47a6f1
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
call fcn.004b88b0
mov edx, dword [ebp - 4]
lea eax, [ebx + 0xc]
call fcn.0045a928
lea eax, [ebx + 0x28]
mov edx, dword [0x4eeffc]
call fcn.0045a928
lea eax, [ebx + 0x2c]
mov edx, dword [0x4ef000]
call fcn.0045a928
lea eax, [ebx + 0x30]
mov edx, dword [0x4ef004]
call fcn.0045a928
lea eax, [ebx + 0x38]
mov edx, dword [0x4ef008]
call fcn.0045a928
lea eax, [ebx + 0x3c]
mov edx, dword [0x4ef00c]
call fcn.0045a928
lea eax, [ebx + 0x34]
mov edx, dword [0x4ef010]
call fcn.0045a928
lea eax, [ebx + 0x40]
mov edx, dword [0x4ef014]
call fcn.0045a928
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47a6f8
lea eax, [ebp - 4]
call fcn.0045a8d4
ret

Function at 0x4d02fc
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, 4
push 0
push 0
dec ecx
jne 0x4d0305
xchg dword [ebp - 4], ecx
push ebx
push esi
mov ebx, ecx
mov dword [ebp - 4], edx
mov esi, eax
mov eax, dword [ebp - 4]
call fcn.0045ad84
xor eax, eax
push ebp
push 0x47a842
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
mov edx, dword [ebp - 4]
call fcn.0045a928
mov al, byte [0x47a850]
push eax
lea eax, [ebp - 8]
push eax
mov eax, dword [ebx]
mov ecx, dword [esi + 0x10]
mov edx, dword [esi + 0x2c]
call fcn.004b9d70
mov edx, dword [ebp - 8]
mov eax, ebx
call fcn.0045a928
mov al, byte [0x47a850]
push eax
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebx]
mov ecx, dword [esi + 0x14]
mov edx, dword [esi + 0x30]
call fcn.004b9d70
mov edx, dword [ebp - 0xc]
mov eax, ebx
call fcn.0045a928
mov al, byte [0x47a850]
push eax
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebx]
mov ecx, dword [esi + 0x1c]
mov edx, dword [esi + 0x38]
call fcn.004b9d70
mov edx, dword [ebp - 0x10]
mov eax, ebx
call fcn.0045a928
mov al, byte [0x47a850]
push eax
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebx]
mov ecx, dword [esi + 0x20]
mov edx, dword [esi + 0x3c]
call fcn.004b9d70
mov edx, dword [ebp - 0x14]
mov eax, ebx
call fcn.0045a928
mov al, byte [0x47a850]
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x1c]
call fcn.004b8e0c
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebx]
mov edx, dword [esi + 0x40]
call fcn.004b9d70
mov edx, dword [ebp - 0x18]
mov eax, ebx
call fcn.0045a928
mov al, byte [0x47a850]
push eax
lea eax, [ebp - 0x20]
push eax
mov eax, dword [ebx]
mov ecx, dword [esi + 0x18]
mov edx, dword [esi + 0x34]
call fcn.004b9d70
mov edx, dword [ebp - 0x20]
mov eax, ebx
call fcn.0045a928
mov al, byte [0x47a850]
push eax
lea eax, [ebp - 0x24]
push eax
mov eax, dword [ebx]
mov ecx, dword [esi + 0xc]
mov edx, dword [esi + 0x28]
call fcn.004b9d70
mov edx, dword [ebp - 0x24]
mov eax, ebx
call fcn.0045a928
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47a849
lea eax, [ebp - 0x24]
mov edx, 9
call fcn.0045a8f8
ret
Function at 0x505d40
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0xa9000]
push edi
jmp 0x505d5a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x505d61
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x505d50
mov eax, 1
add ebx, ebx
jne 0x505d73
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x505d84
jne 0x505da3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x505da3
dec eax
add ebx, ebx
jne 0x505d90
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x505d68
add ebx, ebx
jne 0x505d9f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x505df5
xor ecx, ecx
sub eax, 3
jb 0x505dbb
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x505e2a
sar eax, 1
mov ebp, eax
jmp 0x505dc6
add ebx, ebx
jne 0x505dc6
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x505d94
inc ecx
add ebx, ebx
jne 0x505dd4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x505d94
add ebx, ebx
jne 0x505de1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x505dd6
jne 0x505df2
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x505dd6
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x505e14
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x505e06
jmp 0x505d56
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x505e14
add edi, ecx
jmp 0x505d56
pop esi
mov edi, esi
mov ecx, 0x3b6d
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x505e32
cmp byte [edi], 0x17
jne 0x505e32
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x505e37
lea edi, [esi + 0xff000]
mov eax, dword [edi]
or eax, eax
je 0x505ea6
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x127708]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x12779c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x505e64
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x1277a4]
or eax, eax
je 0x505ea0
mov dword [ebx], eax
add ebx, 4
jmp 0x505e81
call dword [esi + 0x1277a0]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x505ed7
cmp al, 0xef
ja 0x505eca
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x505eac
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x505eb9
mov ebp, dword [esi + 0x1277a8]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x227]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x505f0b
sub esp, 0xffffff80
jmp 0x435126
Function at 0x16960b9
Capabilities:
Encode data using xor

Disassembly:
pushfd
fild word [eax]
xchg ebx, eax
add byte [eax], ah
add byte [edi + 0x34], bl
lea eax, [eax]
add byte [esi], al
stc
dec ecx
mov eax, 0x6a5f004e
add byte [esi + ebx*8], dl
add byte [eax], cl
add al, dh
add byte [edi], dh
fld qword [eax]
lcall 0x2200, 0x32fb494
adc eax, 0xa46200
rol byte [eax], 0x4e
add byte [ebx + ebp], ch
arpl word [eax], ax
mov es, word [eax]
jne 0x169611a
dec esp
add ah, bl
mov al, 0xb5
lahf
das
xchg esi, eax
add byte [eax + 0x3e020093], dh
add byte [edi + 0x4d008800], bl
add byte [ebx - 0x76aa1500], bh
in eax, 0x56
add byte [ecx - 1], bl
add byte [eax + 0x250010], bl
aad 0
xor byte [ecx + 0x3b001700], dh
add byte [esi + 0x1a], bl
insb byte es:[edi], dx
add byte [ebx], dh
jne 0x16960af
push esi
pop edi
test eax, 0x15b00
mov bh, 0xb4
add cl, ah
add byte [ebx - 0x76ff2500], bh
add al, dl
cmp esp, dword [ebx]
pop ss
add ch, dl
xor al, byte [eax]
xor ebp, 0xda008900
add byte [ebx + 0x17], al
inc ebx
pop ss
add byte [eax + eax + 4], ch
add dh, bh
jg 0x1696157
add byte [eax], ch
dec edi
pop esi
not byte [ecx + 0x66]
add byte [eax - 0x641eff4a], bl
add ch, ch
add dh, ch
add byte [ecx + 0x4b007900], dh
pop edx
int 0xb3
lahf
add byte [ecx + 0x4e830061], bh
add byte [edx], dl
insd dword es:[edi], dx
add byte [edi + ebx*2 + 0x2900ba00], ah
add byte [ebp - 0x2a], bl
add byte [esi - 0x7b], ch
cld
push ebp
jns 0x16960f8
add byte [ecx + 0x32], cl
add byte [esi + ebx*8], ah
add byte [esi], ch
movsd dword es:[edi], dword [esi]
add byte [ecx], cl
hlt
add byte [edi], bh
add byte gs:[0x66004f00], ch
jg 0x1696163
jg 0x1696163
outsd dx, dword [esi]
xchg edx, esp
pop ebx
das
mov ebx, 0xd17a00
xchg byte [edx - 0x29ff2f00], dh
add byte [ecx - 0x6dff0b00], ah
inc ebp
rol dh, cl
lock add byte [edi - 0x27], ch
add byte [ebx - 0x67ffb000], al
add ch, bh
pop eax
add dl, bh
add byte [eax], bh
add ch, ch
fild word [esi - 0x6fe0da00]
xchg ecx, eax
add byte [ebx], ch
in eax, 0
mov edi, 0x750095
add dword [eax], eax
movsd dword es:[edi], dword [esi]
add byte [ecx + 0x517cd900], ch
jge 0x1696161
add byte [edi + 0x6a], dl
add byte [ebx], bl
pop esi
add dh, ch
add bh, ch
add byte [edx + 0x18001c], bl
fadd qword [eax]
inc esp
popal
add byte [ebp - 0x63], cl
invalid

Function at 0x171fd31
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xd8
xchg ecx, ecx
call fcn.01720123
push edx
pop edx
lea eax, [ebp - 0xd8]
pushfd
push eax
add esp, 4
popfd
mov ebx, 0x61
pushfd
xor ecx, 0xe3420ad5
xor ecx, 0xe3420ad5
popfd
invalid
invalid