joyce8/EMBER2024-capa huggingface dataset:
Function at 0x3001b7a0
Capabilities:
Resume thread

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0xc]
push esi
xor edx, edx
test ebp, ebp
push edi
mov edi, dword [esp + 0x18]
mov ebx, eax
je 0x3001b7df
mov eax, dword [ebp + 0x18]
cmp eax, edi
jne 0x3001b7c2
mov eax, dword [eax]
mov dword [ebp + 0x18], eax
jmp 0x3001b7da
cmp dword [eax], 0
je 0x3001b7df
mov ecx, dword [eax]
cmp ecx, edi
je 0x3001b7d6
mov eax, ecx
cmp dword [eax], 0
jne 0x3001b7c7
jmp 0x3001b7df
mov ecx, dword [edi]
mov dword [eax], ecx
mov edx, 1
test ebx, ebx
mov esi, dword [esp + 0x1c]
je 0x3001b816
mov eax, dword [ebx + 0x18]
cmp eax, esi
jne 0x3001b7f5
mov eax, dword [eax]
mov dword [ebx + 0x18], eax
jmp 0x3001b813
cmp dword [eax], 0
je 0x3001b816
lea ebx, [ebx]
mov ecx, dword [eax]
cmp ecx, esi
je 0x3001b80f
mov eax, ecx
cmp dword [eax], 0
jne 0x3001b800
jmp 0x3001b816
mov ecx, dword [esi]
mov dword [eax], ecx
or edx, 2
mov eax, edx
dec eax
je 0x3001b967
dec eax
je 0x3001b94d
dec eax
je 0x3001b832
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret 0x10
mov edx, dword [ebp + 0x20]
mov al, byte [esp + 0x20]
dec edx
mov dword [ebp + 0x20], edx
mov ecx, dword [ebx + 0x20]
dec ecx
test al, 1
mov dword [ebx + 0x20], ecx
je 0x3001b8da
mov eax, dword [ebp + 0x18]
test eax, eax
mov eax, dword [ebx + 0x18]
jne 0x3001b8a1
test eax, eax
jne 0x3001b86b
push ebx
push ebp
call fcn.3001bb10
mov esi, 3
jmp 0x3001b922
mov esi, ebp
call fcn.3001b710
mov esi, dword [ebx + 0x14]
mov dword [ebx], 4
mov edi, dword [ebp + 0xc]
call fcn.3001b3b0
mov eax, ebp
call fcn.3001b750
mov eax, ebx
mov dword [ebx], 2
call fcn.3001ba00
mov esi, 1
jmp 0x3001b922
test eax, eax
jne 0x3001b8da
mov esi, ebx
call fcn.3001b710
mov esi, dword [ebp + 0x14]
mov dword [ebp], 4
mov edi, dword [ebx + 0xc]
call fcn.3001b3b0
mov eax, ebx
call fcn.3001b750
mov eax, ebp
mov dword [ebp], 2
call fcn.3001ba00
mov esi, 2
jmp 0x3001b922
push ebp
call fcn.3001b980
cmp dword [ebp], 0
mov esi, dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov edi, dword [sym.imp.KERNEL32.dll_ResumeThread]
mov dword [ebp], 1
jne 0x3001b901
mov edx, dword [ebp + 0xc]
push edx
call edi
jmp 0x3001b907
mov eax, dword [ebp + 0x14]
push eax
call esi
cmp dword [ebx], 0
mov dword [ebx], 1
jne 0x3001b91a
mov ecx, dword [ebx + 0xc]
push ecx
call edi
jmp 0x3001b920
mov edx, dword [ebx + 0x14]
push edx
call esi
xor esi, esi
mov ebp, dword [esp + 0x18]
mov eax, dword [ebp + 4]
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
call ebx
mov edi, dword [esp + 0x1c]
mov ecx, dword [edi + 4]
push ecx
call ebx
xor eax, eax
mov dword [ebp + 4], eax
mov dword [edi + 4], eax
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
ret 0x10
mov edx, dword [esp + 0x20]
push edx
mov edi, esi
mov eax, ebx
call fcn.3001b6b0
add esp, 4
pop edi
pop esi
pop ebp
shl eax, 1
pop ebx
ret 0x10
mov eax, dword [esp + 0x20]
push eax
mov eax, ebp
call fcn.3001b6b0
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
ret 0x10
Function at 0x3001ba00
Capabilities:
Resume thread

Disassembly:
cmp dword [eax], 0
mov dword [eax], 1
jne 0x3001ba16
mov eax, dword [eax + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
ret
mov ecx, dword [eax + 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
ret

Function at 0x3001ba30
Capabilities:
Resume thread

Disassembly:
push esi
mov esi, eax
mov eax, dword [esi + 8]
push edi
mov edi, dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov eax, edi
sub eax, 0
mov dword [esi], 3
je 0x3001ba5e
sub eax, 2
jne 0x3001ba68
mov ecx, dword [esi + 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
jmp 0x3001ba68
mov edx, dword [esi + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov eax, dword [esi + 0xc]
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, dword [esi + 0x14]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
call edi
mov edx, dword [esi + 0xc]
push edx
call edi
mov eax, dword [esi + 8]
push eax
call edi
cmp byte [esi - 2], 3
jne 0x3001baa1
movzx ecx, byte [esi - 1]
mov edx, esi
sub edx, ecx
push edx
call dword [esi - 8]
pop edi
pop esi
ret
movzx eax, byte [esi - 1]
sub esi, eax
push esi
call fcn.300068ed
add esp, 4
pop edi
pop esi
ret

Function at 0x3001bb10
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, dword [esp + 8]
test ebp, ebp
jne 0x3001bb2e
mov eax, dword [esp + 0xc]
test eax, eax
je 0x3001bbc9
call fcn.3001ba30
pop ebp
ret 8
push ebx
mov ebx, dword [esp + 0x10]
test ebx, ebx
jne 0x3001bb43
mov eax, ebp
call fcn.3001ba30
pop ebx
pop ebp
ret 8
mov eax, dword [ebp + 8]
push esi
mov esi, dword [ebp]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_SetEvent]
push eax
call edi
mov eax, esi
sub eax, 0
mov dword [ebp], 3
je 0x3001bb73
sub eax, 2
jne 0x3001bb7d
mov ecx, dword [ebp + 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
jmp 0x3001bb7d
mov edx, dword [ebp + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov eax, dword [ebx + 8]
mov esi, dword [ebx]
push eax
call edi
mov eax, esi
sub eax, 0
mov dword [ebx], 3
je 0x3001bba3
sub eax, 2
jne 0x3001bbad
mov ecx, dword [ebx + 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
jmp 0x3001bbad
mov edx, dword [ebx + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov esi, dword [ebx + 0xc]
mov edi, dword [ebp + 0xc]
call fcn.3001b3b0
mov eax, ebp
call fcn.3001b750
mov eax, ebx
call fcn.3001b750
pop edi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x425077
Capabilities:
Encode data using xor

Disassembly:
push ebx
ror dh, 0x3b
mov ch, 0x12
ficom dword [ebx + 0x169f33fa]
adc ch, byte [ebx + 0x64]
into
cmp esi, dword [ebp - 0x56c25ee]
xor ebx, dword [edi + 0x646b1216]
push 0x761b9c0
outsd dx, dword [esi]
adc ah, byte [esi + 0x799a613]
sbb edx, dword [ebx]
sbb al, 0x29
stc
mov dh, 0x68
loopne 0x425079
push 0xbf5ca702
lahf
invalid

Function at 0x48424a
Capabilities:
Encode data using xor

Disassembly:
ja 0x484257
scasb al, byte es:[edi]
adc eax, 0x3cc344cb
cmp dword [ebx], esi
in al, dx
cmp byte [ebx - 0x17], cl
das
pop ecx
and esi, dword [edx]
int 0xcb
jae 0x48421c
test dword ss:[eax - 0x70], esi
pop ds
outsd dx, dword [esi]
sbb al, 0x72
push ebx
in al, dx
pushfd
fiadd dword [ebx]
shr ebp, cl
cmc
and cl, byte cs:[eax - 0x14]
dec eax
in al, dx
in al, 0x75
cmp dword [bp + si + 0x57df], ebx
or dword [ecx], 0xfffffff3
scasd eax, dword es:[edi]
repe scasd eax, dword es:[edi]
imul eax, esi, 0x945cc633
push esp
in al, dx
jecxz 0x48426e
cmpsb byte [esi], byte es:[edi]
lcall 0xe481, 0x18e3e5fc
pushfd
stosb byte es:[edi], al
jl 0x4841f1
bound ebp, qword [edx]
adc byte [edx - 0x439ea40e], 0xf
mov edi, 0xd4db71b0
jno 0x484227
aam 0xf6
loopne 0x48429c
jno 0x484227
aam 0xf6
loopne 0x48429c
or eax, 0xa3bd1b07
and ebx, dword [ecx - 0x4229ea34]
and dword [edx + 0x53], esp
sbb edi, dword [ebp - 0x3366dc5d]
adc eax, 0x6221bdd6
push ebx
int3
mov esi, dword [0x9e5ec3f]
in eax, 9
lds esi, [ecx]
clc
add edi, edi
sub dword [ecx - 0x5722b97], edi
cli
inc esp
xor ecx, esp
pushal
sbb al, 0xce
inc edx
mov edx, ecx
sti
sub ebx, dword [ebp - 0x2c]
insd dword es:[edi], dx
in al, 0x94
inc ebp
movsb byte es:[edi], byte [esi]
cmp dword [esi], 0x13
jecxz 0x484262
out dx, eax
xchg ecx, eax
imul dword [edx + 0x34947a41]
invalid
and dword [ecx], esp
les esi, [edx]
mov edi, 0x28af3311
in al, 0x2e
inc edi
adc dword [ebx], esi
scasd eax, dword es:[edi]
sub ah, ah
inc edi
loop 0x4842cd
jecxz 0x4842f2
cmp esi, ebx
sub al, 4
test dword [edx], 0x64e0e7e4
and eax, 0x6284c91f
nop
insd dword es:[edi], dx
fdivrp st(2)
jno 0x484252
test byte [esi - 0x4a4e4f1d], 0xf8
jge 0x4842d6
mov ebx, dword [edx]
inc esi
or esp, dword [ebp - 0x35]
test al, 0xe9
int1
out dx, al
cld
jecxz 0x4842a1
retf 0xab0d
or eax, 0x2f56a2ab
or al, 0xf2
mov word [ebp + ecx*4 - 0x1e], ss
clc
mov bl, 0x37
mov dword [0x63c6f5c1], eax
aaa
xor ecx, ebp
cmp bl, byte [ecx + 0xe]
pop es
sub byte fs:[esi - 0x523cc2ae], dh
cmp al, 0x8b
sbb dword [ebx + 0x30], edi
or ebx, dword [ebp - 0x1d]
repne scasb al, byte es:[edi]
fbld tbyte [eax + ebp*4 + 0x77f50ad2]
shl esp, 0x77
inc edi
cmp dh, ch
add al, 0xc8
push 0x4433cca7
push es
sub eax, 0xd41cd073
push 0xffffffffffffffb1
mov eax, 0x31ebf784
pop esp
and bh, byte [edx]
mov word [ebp - 0x3c499204], ds
enter 0x2ae9, 0x65
outsd dx, dword [esi]
hlt
Function at 0x494425
Capabilities:
Encode data using xor

Disassembly:
into
sub byte [esi - 0x2d1e7191], 0x1e
bound esi, qword [edx]
xor dword [ebx], esi
inc esi
imul edx, dword [edx], 0xffffffa9
mov word [esi], ds
nop
mov al, byte [0xfc13eef2]
cmp al, 0x34
aaa
xchg ecx, eax
mov dl, 0xff
jb 0x494400
and edi, dword [edx + 0x4647ff8c]
pushfd
iretd
xor bh, bh
sub byte [edi + 0x7a], 0xae
mov cl, byte [esi - 0x41]
retf 0xdafd
popfd
mov dl, 0xa1
and eax, 0x11cd8a82
add byte [edi], dl
or esi, dword [eax]
out dx, al
cli
outsb dx, byte [esi]
xor dh, byte [edx + 0x6eb75242]
sbb dl, byte [edx + 0x33]
or byte [edx], al
jae 0x4943c3
enter 0xffffffffffff9a42, 0x25
mov dword [0xdf55771c], eax
in eax, dx
xor dword ss:[ecx], eax
mov ebp, dword [0xe7e2f702]
aas
lodsb al, byte [esi]
xchg ebp, eax
mov bh, 0xaa
mov bh, 0xaa
sbb edi, dword [edx]
mov dword ss:[0xefaecaf4], eax
adc al, 0xba
xor cl, bl
wait
lodsd eax, dword [esi]
ja 0x494458
add ch, ch
ljmp 0x9911

Function at 0x629064
Capabilities:
Query environment variable

Disassembly:
cmp eax, 1
jne 0x6290ee
cmp esi, ebx
jne 0x62907d
call ebp
mov esi, eax
cmp esi, ebx
je 0x62913f
cmp word [esi], bx
mov eax, esi
je 0x629092
inc eax
inc eax
cmp word [eax], bx
jne 0x629084
inc eax
inc eax
cmp word [eax], bx
jne 0x629084
sub eax, esi
mov edi, dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
sar eax, 1
push ebx
push ebx
inc eax
push ebx
push ebx
push eax
push esi
push ebx
push ebx
mov dword [esp + 0x34], eax
call edi
mov ebp, eax
cmp ebp, ebx
je 0x6290e3
push ebp
call fcn.0062aa92
cmp eax, ebx
pop ecx
mov dword [esp + 0x10], eax
je 0x6290e3
push ebx
push ebx
push ebp
push eax
push dword [esp + 0x24]
push esi
push ebx
push ebx
call edi
test eax, eax
jne 0x6290df
push dword [esp + 0x10]
call fcn.0062a9a9
pop ecx
mov dword [esp + 0x10], ebx
mov ebx, dword [esp + 0x10]
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
jmp 0x629141
cmp eax, 2
jne 0x62913f
cmp edi, ebx
jne 0x629103
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStrings]
mov edi, eax
cmp edi, ebx
je 0x62913f
cmp byte [edi], bl
mov eax, edi
je 0x629113
inc eax
cmp byte [eax], bl
jne 0x629109
inc eax
cmp byte [eax], bl
jne 0x629109
sub eax, edi
inc eax
mov ebp, eax
push ebp
call fcn.0062aa92
mov esi, eax
pop ecx
cmp esi, ebx
jne 0x629129
xor esi, esi
jmp 0x629134
push ebp
push edi
xor eax, eax
Function at 0x6295dd
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x6303f0
cmp edx, dword [eax]
je 0x6295ff
add eax, 8
inc ecx
cmp eax, 0x630480
jl 0x6295f0
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x6303f0]
jne 0x62972d
mov eax, dword [0x638d98]
cmp eax, 1
je 0x629707
test eax, eax
jne 0x629630
cmp dword [0x630318], 1
je 0x629707
cmp edx, 0xfc
je 0x62972d
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x629667
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.00629fc0
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.0062a450
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x6296aa
lea eax, [ebp - 0x1a4]
push eax
call fcn.0062a450
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x62e73c
push edi
call fcn.0062c320
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.00629fc0
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.00629fd0
lea eax, [ebp - 0xa0]
push 0x62e71c
push eax
call fcn.00629fd0
push dword [esi + 0x6303f4]
lea eax, [ebp - 0xa0]
push eax
call fcn.00629fd0
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.0062c294
add esp, 0x2c
pop edi
jmp 0x62972d
lea eax, [ebp + 8]
lea esi, [esi + 0x6303f4]
push 0
push eax
push dword [esi]
call fcn.0062a450
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret

Function at 0x4562fa
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [0x47207c]
test eax, eax
je 0x456339
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x456339
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x456339
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x456339
cmp dword [ecx + 0x74], 0xe
jbe 0x456339
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x1009f473
Capabilities:
Get number of processors

Disassembly:
jmp 0x10093794
call fcn.1009377f
salc
arpl word [ebp - 0x79], cx
loop 0x1009378a
adc eax, 0x24748b56
add al, 0x8d
mov dh, 0xd4
adc byte [edx], al
add byte [ecx + 0x5e042474], cl
push edx
mov dword [esp], ebp
push esp
pop ebp
push ebp
mov ebp, esp
add ebp, 4
sub ebp, 0x80
xchg dword [esp], ebp
pop esp
sub esp, 4
mov dword [esp], ebx
push edi
mov dword [esp], esi
push 0x188b
mov dword [esp], edi
jmp 0x100b93b3
push ebx
mov ebx, 8
add ebx, ebp
mov eax, dword [ebx]
pop ebx
sub esp, 4
mov dword [esp], eax
jmp 0x100b21dd
jmp 0x1009e476
push 0
push 0x41797261
push 0x7262694c
push 0x64616f4c
lea ecx, [ebp - 0x2c]
sub esp, 4
mov dword [esp], ecx
jmp 0x100ad856
push ecx
mov ecx, dword [esp + 4]
lea ecx, [ecx + 0x1983f]
mov dword [esp + 4], ecx
pop ecx
jmp 0x100b5e32
jmp 0x100ad86d
call fcn.100ad858
adc byte [eax - 0x77], dl
loopne 0x100ad87c
add al, 0
add byte [eax], al
add eax, 4
xchg dword [esp], eax
pop esp
rol byte [edi + eax*4], 4
and al, 0x5c
push eax
pop dword [ebp - 4]
push ecx
mov ecx, 0xc
add ecx, ebp
mov eax, dword [ecx]
pop ecx
push esi
mov dword [esp], eax
push dword [ebp - 4]
sub dword [esp], 0x3f8325ed
pop ecx
add ecx, 0x3f8325ed
push esi
mov dword [esp], ecx
push eax
mov eax, 8
add eax, ebp
mov edx, dword [eax]
pop eax
push eax
mov eax, 0x64
add edx, eax
pop eax
push ebx
mov dword [esp], edx
jmp 0x1009377d
jmp 0x100b21f4
call fcn.100b21df
or eax, dword [ebp + 0x68]
mov byte [eax], 0
jmp 0x10093bce
push esi
mov esi, 0x6114390f
xor esi, 0x61143917
mov eax, esi
pop esi
mov eax, dword fs:[eax]
push eax
pop dword [ebp - 4]
push dword [ebp - 4]
pop eax
push dword [eax + 0x30]
sub dword [esp], 0x63f80c4b
pop ecx
add ecx, 0x63f80c4b
push eax
mov eax, 0xfffffff8
add eax, ebp
mov dword [eax], ecx
pop eax
push dword [ebp - 8]
pop edx
push ecx
mov ecx, 8
add ecx, edx
mov eax, dword [ecx]
pop ecx
push edx
mov edx, 0xffffffec
add edx, ebp
mov dword [edx], eax
pop edx
push ebx
mov ebx, 0
mov dword [ebp - 0x10], ebx
pop ebx
cmp dword [ebp - 0x10], 0
je 0x10094698
jmp 0x10095265

Function at 0x100be6f2
Capabilities:
Access peb ldr_data

Disassembly:
push eax
mov eax, dword [esp + 4]
lea eax, [eax - 0x4e23]
mov dword [esp + 4], eax
pop eax
jmp 0x100ada70

Function at 0x10332764
Capabilities:
Encode data using xor

Disassembly:
sub esp, 4
mov dword [esp], ecx
cmp eax, 0x1000
lea ecx, [esp + 8]
jb 0x103327c2
jmp 0x10332781
push ebx
mov ebx, 0x1000
sub ecx, ebx
pop ebx
push esi
mov esi, 0x42603735
add esi, 0x62b848ad
not esi
xor esi, 0xa3b2af6
xor esi, 0x5731f4a
shr esi, 4
xor esi, 0x55aeb5a
sub eax, esi
pop esi
test dword [ecx], eax
cmp eax, 0x1000
jae 0x10332781
jmp 0x103327c2
sub ecx, 0x42861a21
sub ecx, eax
add ecx, 0x42861a21
push esp
pop eax
test dword [ecx], eax
mov esp, ecx
push dword [eax]
pop ecx
push dword [eax + 4]
xor dword [esp], 0x1d9f7243
pop eax
xor eax, 0x1d9f7243
push ecx
mov dword [esp], eax
ret
Function at 0x103cb6d0
Capabilities:
Packed with generic packer

Disassembly:
cmp byte [esp + 8], 1
jne 0x103cb8bd
pushal
mov esi, section.UPX1
lea edi, [esi - 0x239000]
push edi
or ebp, 0xffffffff
jmp 0x103cb6fa
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x103cb701
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x103cb6f0
mov eax, 1
add ebx, ebx
jne 0x103cb713
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x103cb724
jne 0x103cb743
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x103cb743
dec eax
add ebx, ebx
jne 0x103cb730
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x103cb708
add ebx, ebx
jne 0x103cb73f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x103cb795
xor ecx, ecx
sub eax, 3
jb 0x103cb75b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x103cb7ca
sar eax, 1
mov ebp, eax
jmp 0x103cb766
add ebx, ebx
jne 0x103cb766
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x103cb734
inc ecx
add ebx, ebx
jne 0x103cb774
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x103cb734
add ebx, ebx
jne 0x103cb781
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x103cb776
jne 0x103cb792
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x103cb776
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x103cb7b4
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x103cb7a6
jmp 0x103cb6f6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x103cb7b4
add edi, ecx
jmp 0x103cb6f6
pop esi
mov edi, esi
mov ecx, 0xdd5e
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x103cb7d2
cmp byte [edi], 0x62
jne 0x103cb7d2
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x103cb7d7
lea edi, [esi + 0x3bc000]
mov eax, dword [edi]
or eax, eax
je 0x103cb84f
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x3cf800]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x3cf954]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x103cb804
mov ecx, edi
jns 0x103cb833
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x3cf958]
or eax, eax
je 0x103cb849
mov dword [ebx], eax
add ebx, 4
jmp 0x103cb821
popal
xor eax, eax
ret 0xc
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x103cb880
cmp al, 0xef
ja 0x103cb873
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x103cb855
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x103cb862
mov ebp, dword [esi + 0x3cf95c]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x217]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x103cb8b4
sub esp, 0xffffff80
jmp 0x1014c39e
Function at 0x108ea40
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x992000]
push edi
or ebp, 0xffffffff
jmp 0x108ea62
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x108ea69
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x108ea58
mov eax, 1
add ebx, ebx
jne 0x108ea7b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x108ea8c
jne 0x108eaab
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x108eaab
dec eax
add ebx, ebx
jne 0x108ea98
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x108ea70
add ebx, ebx
jne 0x108eaa7
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x108eafd
xor ecx, ecx
sub eax, 3
jb 0x108eac3
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x108eb32
sar eax, 1
mov ebp, eax
jmp 0x108eace
add ebx, ebx
jne 0x108eace
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x108ea9c
inc ecx
add ebx, ebx
jne 0x108eadc
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x108ea9c
add ebx, ebx
jne 0x108eae9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x108eade
jne 0x108eafa
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x108eade
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x108eb1c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x108eb0e
jmp 0x108ea5e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x108eb1c
add edi, ecx
jmp 0x108ea5e
pop esi
mov edi, esi
mov ecx, 0x2ba8a1
mov al, 0xe8
repne scasb al, byte es:[edi]
jne 0x108eb57
cmp byte [edi], 0x23
jne 0x108eb3c
mov eax, dword [edi]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
add eax, esi
stosd dword es:[edi], eax
jmp 0x108eb3a
lea edi, [esi + 0xc8a000]
mov eax, dword [edi]
or eax, eax
je 0x108eb9f
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xca01d4]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xca02d8]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x108eb5d
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xca02dc]
or eax, eax
je 0x108eb99
mov dword [ebx], eax
add ebx, 4
jmp 0x108eb7a
call dword [esi + 0xca02ec]
mov ebp, dword [esi + 0xca02e0]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x21f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x108ebd3
sub esp, 0xffffff80
jmp 0x6eedcc
Function at 0x44b769
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x44f190
cmp edx, dword [eax]
je 0x44b78b
add eax, 8
inc ecx
cmp eax, 0x44f220
jl 0x44b77c
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x44f190]
jne 0x44b8b9
mov eax, dword [0x44fbb0]
cmp eax, 1
je 0x44b893
test eax, eax
jne 0x44b7bc
cmp dword [0x44f0e4], 1
je 0x44b893
cmp edx, 0xfc
je 0x44b8b9
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x44b7f3
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.0044c670
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.0044c490
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x44b836
lea eax, [ebp - 0x1a4]
push eax
call fcn.0044c490
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x44e45c
push edi
call fcn.0044cf00
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.0044c670
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.0044c680
lea eax, [ebp - 0xa0]
push 0x44e43c
push eax
call fcn.0044c680
push dword [esi + 0x44f194]
lea eax, [ebp - 0xa0]
push eax
call fcn.0044c680
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.0044ce75
add esp, 0x2c
pop edi
jmp 0x44b8b9
lea eax, [ebp + 8]
lea esi, [esi + 0x44f194]
push 0
push eax
push dword [esi]
call fcn.0044c490
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x41eb83
Capabilities:
Encode data using xor

Disassembly:
or al, 8
mov edx, eax
and edx, 0x18
mov ebp, ecx
xor ebp, 0x4d517aec
add ebp, edx
mov edx, ebp
and edx, esi
add edx, edx
add ebp, esi
sub edx, ebp
lea esi, [edx + edx]
cmp byte [eax], 0x13
lodsd eax, dword [esi]
out 0x3a, al
xor edx, 0x62
sub edx, esi
add dl, 2
mov byte [esp + ecx + 8], dl
inc ecx
add eax, 2
cmp ecx, 0x10
jne 0x41eb7f
movzx eax, word [esp + 8]
test ax, ax
je 0x41ebe0
lea ecx, [esp + 0xa]
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [ebx], ax
add ebx, 2
movzx eax, word [ecx]
add ecx, 2
test ax, ax
jne 0x41ebcf
mov word [ebx], 0
mov dword [esp + 8], 0x696a6b8a
xor eax, eax
add al, ah
dec esi
mov bh, 0xb6
dec esp
add al, 8
lea edx, [eax - 0x13ae84e9]
and edx, ecx
add edx, edx
neg edx
add edx, eax
add edx, 0xec517b17
add dl, cl
add dl, 0x8d
mov byte [esp + eax + 8], dl
mov ecx, eax
xor ecx, 1
and eax, 1
lea eax, [ecx + eax*2]
cmp eax, 4
jb 0x41ebf2
push 0
push 0
push 0xc00000
lea eax, [esp + 0x14]
push eax
push edi
push dword [esp + 0x18]
invalid