joyce8/EMBER2024-capa huggingface dataset:
Function at 0x446000
Capabilities:
Accept command line arguments
Parse pe header
Resolve function by parsing pe exports
Terminate process

Disassembly:
call 0x446005
pop ebx
sub ebx, fcn.00401032
mov edi, dword [esp]
and edi, 0xffff0000
cmp word [edi], 0x5a4d
jne 0x44602a
mov esi, edi
add esi, dword [esi + 0x3c]
cmp word [esi], 0x4550
jne 0x44602a
jmp 0x44603a
sub edi, 0x10000
cmp edi, 0x70000000
jb 0x44603a
jmp 0x446015
mov dword [ebx + 0x4011d9], edi
mov esi, dword [esi + 0x78]
add esi, edi
push esi
mov ebp, dword [esi + 0x18]
mov esi, dword [esi + 0x20]
add esi, edi
xor edx, edx
push esi
mov edi, dword [esi]
add edi, dword [ebx + 0x4011d9]
lea esi, [ebx + 0x40119e]
mov ecx, 0xf
repe cmpsb byte [esi], byte es:[edi]
jne 0x44606e
pop esi
mov edx, esi
pop esi
jmp 0x44607f
pop esi
add esi, 4
inc edx
cmp edx, ebp
jb 0x446050
sub esp, 4
jmp 0x446199
sub edx, dword [esi + 0x20]
mov eax, dword [ebx + 0x4011d9]
sub edx, eax
shr edx, 1
add edx, dword [esi + 0x24]
add edx, eax
movzx eax, word [edx]
shl eax, 2
add eax, dword [esi + 0x1c]
add eax, dword [ebx + 0x4011d9]
mov eax, dword [eax]
add eax, dword [ebx + 0x4011d9]
mov edi, eax
mov ebp, esp
mov edx, dword [ebx + 0x4011d9]
lea eax, [ebx + 0x4011ad]
push eax
push edx
call edi
sub esp, 0x104
push esp
push 0x104
call eax
lea eax, [ebx + 0x4011ba]
push eax
mov edx, dword [ebx + 0x4011d9]
push edx
call edi
lea ecx, [ebx + 0x4011c3]
push ecx
mov ecx, esp
add ecx, 4
push ecx
call eax
lea eax, [ebx + 0x4011cd]
push eax
mov edx, dword [ebx + 0x4011d9]
push edx
call edi
mov ecx, esp
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
push ecx
call eax
mov esi, eax
lea ecx, [ebx + 0x401204]
push ecx
push ecx
mov edx, dword [ebx + 0x4011d9]
push edx
call edi
pop ecx
push 0
push ecx
add ecx, 0xa
mov edx, dword [ecx]
push edx
push ecx
mov edx, 0x905a4d
mov dword [ecx], edx
push esi
call eax
lea eax, [ebx + 0x4011ec]
push eax
mov edx, dword [ebx + 0x4011d9]
push edx
call edi
push esi
call eax
lea eax, [ebx + 0x4011dd]
push eax
mov edx, dword [ebx + 0x4011d9]
push edx
call edi
sub esp, 0x44
mov edx, esp
mov esi, 0
mov ecx, 0x11
mov dword [edx], esi
add edx, 4
loop 0x44616a
mov edx, 0x44
mov dword [esp], edx
sub esp, 0x10
mov edx, esp
push esp
add edx, 0x10
push edx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
add edx, 0x44
push edx
call eax
mov esp, ebp
jmp 0x406e20

Function at 0x44660e
Capabilities:
Parse pe header

Disassembly:
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x446651
mov ecx, dword [eax + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x446651
mov ecx, dword [esp + 4]
add eax, 4
mov dword [ecx], eax
mov ecx, dword [esp + 8]
add eax, 0x14
mov dword [ecx], eax
mov ecx, 0x10b
cmp word [eax], cx
jne 0x446651
mov ecx, dword [esp + 0xc]
add eax, 0xe0
mov dword [ecx], eax
xor eax, eax
inc eax
jmp 0x446653
xor eax, eax
ret 0xc
Function at 0x44cae9
Capabilities:
Check for software breakpoints

Disassembly:
mov eax, dword [0x400820]
mov eax, dword [eax]
mov eax, dword [eax + 0x48]
push esi
xor ecx, ecx
xor edx, edx
mov esi, 0xff
cmp byte [eax], 0xcc
jne 0x44cb17
cmp byte [eax + 1], cl
jne 0x44cb17
cmp byte [eax + 2], cl
jne 0x44cb17
cmp byte [eax + 3], cl
jne 0x44cb17
cmp byte [eax - 6], 0xe4
je 0x44cb21
inc eax
inc edx
cmp edx, esi
jl 0x44cafd
xor eax, eax
pop esi
ret
xor edx, edx
cmp byte [eax], 0xff
jne 0x44cb34
cmp byte [eax + 1], 0x75
jne 0x44cb34
cmp byte [eax + 2], 0xf4
je 0x44cb3d
inc eax
inc edx
cmp edx, 0x30
jl 0x44cb23
jmp 0x44cb1d
add eax, 5
mov edx, dword [eax]
lea edx, [edx + eax + 4]
mov dword [0x400908], edx
cmp byte [eax], 0xff
jne 0x44cb5d
cmp byte [eax + 1], 0x75
jne 0x44cb5d
cmp byte [eax + 2], 0xfc
je 0x44cb65
inc eax
inc ecx
cmp ecx, esi
jl 0x44cb4c
jmp 0x44cb1d
add eax, 4
mov ecx, dword [eax]
lea eax, [ecx + eax + 4]
mov dword [0x400914], eax
xor eax, eax
inc eax
pop esi
ret

Function at 0x5d8ac1
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x5d87dc
add esi, esi
add ecx, 1
dec esi
call fcn.005d8afa
dec ecx
sub esi, 0x8031573d
xor dword [ebx], eax
or ecx, ecx
or esi, esi
add ecx, esi
add ebx, 2
and esi, ecx
cmp ebx, edi
jl fcn.005d8ac1
sub esi, 0x7e98348c
mov esi, esi
ret
Function at 0x401434
Capabilities:
Copy file
Create shortcut via ishelllink
Delete file
Delete registry value
Enumerate files on windows
Move file
Query environment variable
Query or enumerate registry key
Query or enumerate registry value
Read .ini file
Read file on windows
Set current directory
Set file attributes
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2dc
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov eax, dword [0x434f08]
push 7
pop ecx
lea edi, [ebp - 0x34]
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [ebp - 0x2c]
mov edx, dword [ebp - 0x34]
mov esi, section..ndata
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x30]
xor ebx, ebx
shl ecx, 0xb
add ecx, esi
mov edi, eax
mov dword [ebp - 0xc], ecx
lea ecx, [ebp - 0x30]
shl edi, 0xb
mov dword [0x40ce4c], ecx
lea ecx, [edx - 2]
add edi, esi
cmp ecx, 0x43
mov dword [ebp - 4], ebx
ja case.0x40148a.66
jmp dword [ecx*4 + 0x402c3c]
push ebx
push eax
call fcn.0040559f
jmp 0x40239d
inc dword [0x433ecc]
cmp dword [ebp - 8], ebx
je 0x40239d
push ebx
call dword [sym.imp.USER32.dll_PostQuitMessage]
jmp 0x40239d
push eax
call fcn.0040136d
dec eax
push ebx
push eax
invalid

Function at 0x40160d
Capabilities:
Get file attributes
Set current directory

Disassembly:
ret

Function at 0x402ea9
Capabilities:
Delete registry key
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
push ebx
push esi
mov esi, dword [ebp + 0x10]
push edi
mov edi, esi
lea eax, [ebp - 4]
and esi, 0x300
push eax
mov eax, esi
and edi, 1
or al, 9
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.004063aa
xor ebx, ebx
invalid

Function at 0x402eda
Capabilities:
Delete registry key
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
ret
Function at 0x405a6e
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, 0x4083f8
and byte [ebp - 0x1f], 0
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x20]
and dword [ebp - 0x14], 0
and dword [ebp - 4], 0
mov dword [ebp - 8], eax
lea eax, [ebp - 0xc]
push esi
push eax
mov byte [ebp - 0x20], 1
push dword [ebp + 8]
mov word [ebp - 0x1e], 4
mov dword [ebp - 0x10], 0x4083e8
mov dword [ebp - 0xc], 0xc
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x405abf
xor eax, eax
jmp 0x405ae6
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
cmp eax, 0xb7
jne 0x405ae6
lea eax, [ebp - 0x20]
push eax
push 0x80000007
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_SetFileSecurityW]
test eax, eax
jne 0x405abb
call esi
pop esi
leave
ret 4

Function at 0x405b20
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
lea eax, [ebp - 0x10]
mov dword [0x430270], 0x44
push eax
xor eax, eax
push 0x430270
push eax
push eax
push 0x4000000
push eax
push eax
push eax
push dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x405b5f
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x10]
leave
ret 4

Function at 0x405b63
Capabilities:
Create process on windows

Disassembly:
mov eax, dword [esp + 4]
push eax
and dword [eax + 0x24], 0
mov dword [eax], 0x3c
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
ret 4

Function at 0x405c01
Capabilities:
Delete directory
Delete file
Set file attributes

Disassembly:
push esi
mov esi, dword [esp + 8]
push edi
push esi
call fcn.00406008
mov edi, eax
cmp edi, 0xffffffff
je 0x405c42
test byte [esp + 0x10], 1
push esi
je 0x405c24
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
jmp 0x405c2a
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x405c33
xor eax, eax
inc eax
jmp 0x405c44
test byte [esp + 0x10], 4
jne 0x405c42
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
xor eax, eax
pop edi
pop esi
ret 8

Function at 0x405c49
Capabilities:
Delete file
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x258
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
invalid

Function at 0x405c5c
Capabilities:
Delete file
Enumerate files on windows

Disassembly:
ret

Function at 0x405c9a
Capabilities:
Enumerate files on windows

Disassembly:
ret
Function at 0x406183
Capabilities:
Get file size

Disassembly:
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetShortPathNameW]
push ebp
push esi
mov esi, dword [esp + 0x14]
push edi
test esi, esi
mov dword [0x430908], 0x55004e
mov dword [0x43090c], 0x4c
mov edi, 0x400
mov ebp, 0x430908
je 0x4061d9
push 1
push 0
push esi
call fcn.0040602d
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
push ebp
push esi
call ebx
test eax, eax
je 0x4062f8
cmp eax, edi
jg 0x4062f8
mov esi, 0x431108
push edi
push esi
push dword [esp + 0x1c]
call ebx
test eax, eax
je 0x4062f8
cmp eax, edi
jg 0x4062f8
push esi
push ebp
push str._ls_ls_r_n
push 0x430508
call dword [sym.imp.USER32.dll_wsprintfA]
mov ebx, eax
mov eax, dword [0x434f10]
add esp, 0x10
push dword [eax + 0x128]
push esi
call fcn.0040657a
push 4
push 0xc0000000
push esi
call fcn.0040602d
mov ebp, eax
cmp ebp, 0xffffffff
mov dword [esp + 0x18], ebp
je 0x4062f8
push 0
push ebp
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
lea eax, [edi + ebx + 0xa]
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
test esi, esi
je 0x4062f1
push edi
push esi
push ebp
call fcn.004060b0
test eax, eax
je 0x4062f1
push str._Rename__r_n
push esi
call fcn.00405f92
test eax, eax
jne 0x40628f
lea eax, [esi + edi]
push str._Rename__r_n
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
add edi, 0xa
jmp 0x4062c4
add eax, 0xa
push 0x40a580
push eax
call fcn.00405f92
mov ebp, eax
test ebp, ebp
je 0x4062c0
lea ecx, [esi + edi]
lea eax, [ecx + ebx]
jmp 0x4062b1
mov dl, byte [ecx]
mov byte [eax], dl
dec eax
dec ecx
cmp ecx, ebp
ja 0x4062ab
sub ebp, esi
inc ebp
mov eax, ebp
mov ebp, dword [esp + 0x18]
jmp 0x4062c6
mov ebp, dword [esp + 0x18]
mov eax, edi
push ebx
add eax, esi
push 0x430508
push eax
call fcn.00405fe8
xor eax, eax
push eax
push eax
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
add edi, ebx
push edi
push esi
push ebp
call fcn.004060df
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
pop ebx

Function at 0x4062fd
Capabilities:
Move file

Disassembly:
push 5
push dword [esp + 0xc]
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
jne 0x406320
push dword [esp + 8]
push dword [esp + 8]
call fcn.00406183
pop ecx
pop ecx
inc dword [0x434f90]
ret 8
Function at 0x40657a
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 0xc]
test eax, eax
jge 0x406598
mov ecx, dword [0x433edc]
lea eax, [eax*4 + 4]
sub ecx, eax
mov eax, dword [ecx]
mov ecx, dword [0x434f38]
push ebx
push esi
push edi
lea edi, [ecx + eax*2]
mov eax, 0x432ea0
cmp dword [ebp + 8], eax
mov esi, eax
jb 0x4065c6
mov ecx, dword [ebp + 8]
sub ecx, eax
sar ecx, 1
cmp ecx, 0x800
jae 0x4065c6
mov esi, dword [ebp + 8]
and dword [ebp + 8], 0
mov cx, word [edi]
test cx, cx
mov dword [ebp + 0xc], ecx
je 0x4067aa
jmp 0x4065da
mov ecx, dword [ebp + 0xc]
mov edx, esi
sub edx, eax
and edx, 0xfffffffe
cmp edx, 0x800
jge 0x4067aa
push 2
pop edx
add edi, edx
cmp cx, 4
jae 0x406788
mov cl, byte [edi + 1]
mov al, byte [edi]
mov dl, cl
mov bl, al
and edx, 0x7f
and ebx, 0x7f
shl edx, 7
movzx eax, al
or edx, ebx
mov ebx, eax
mov dword [ebp - 8], edx
mov edx, 0x8000
or ebx, edx
push 2
movzx ecx, cl
mov dword [ebp - 0x18], ebx
pop ebx
mov dword [ebp - 0xc], ecx
or ecx, edx
add edi, ebx
cmp word [ebp + 0xc], bx
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], ecx
jne 0x40672c
cmp dword [0x434f84], 0
je 0x40664b
push 4
pop ebx
test al, al
jns 0x40668a
mov ecx, eax
and eax, 0x3f
and ecx, 0x40
push ecx
mov ecx, dword [0x434f38]
push esi
lea eax, [ecx + eax*2]
push eax
push str.SoftwareMicrosoftWindowsCurrentVersion
push 0x80000002
call fcn.0040640b
cmp word [esi], 0
jne 0x406713
push dword [ebp - 0xc]
push esi
call fcn.0040657a
jmp 0x40670d
cmp eax, 0x25
jne 0x40669d
push 0x400
push esi
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
jmp 0x40670d
cmp eax, 0x24
jne 0x406709
push 0x400
push esi
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
xor ebx, ebx
jmp 0x406709
mov eax, dword [0x434f04]
dec ebx
test eax, eax
je 0x4066d1
push esi
push 0
push 0
push dword [ebp + ebx*4 - 0x18]
push dword [0x434f08]
call eax
test eax, eax
je 0x40670d
lea eax, [ebp - 4]
push eax
push dword [ebp + ebx*4 - 0x18]
push dword [0x434f08]
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
jne 0x406705
push esi
push dword [ebp - 4]
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
push dword [ebp - 4]
mov dword [ebp + 0xc], eax
call dword [sym.imp.ole32.dll_CoTaskMemFree]
cmp dword [ebp + 0xc], 0
jne 0x40670d
and word [esi], 0
test ebx, ebx
jne 0x4066b2
cmp word [esi], 0
je 0x406724
cmp dword [ebp - 0xc], 0x1a
jne 0x406724
push str.MicrosoftInternet_ExplorerQuick_Launch
push esi
call sub.KERNEL32.dll_lstrcatW
push esi
call fcn.004067c4
jmp 0x406778
cmp word [ebp + 0xc], 3
jne 0x406764
mov ebx, dword [ebp - 8]
cmp ebx, 0x1d
jne 0x406749
push dword [0x434f08]
push esi
call fcn.00406484
jmp 0x40675a
invalid
Function at 0x401e1e
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xcc
mov eax, dword [0x4a4fec]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, 0x4800b8
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x40], eax
mov eax, 0x47fd28
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
movzx eax, byte [ebp + 8]
push eax
push 0x4a93b8
push 0x47fce4
lea eax, [ebp - 0xcc]
push 0x18
push eax
mov dword [ebp - 0xcc], 0x4800ac
mov dword [ebp - 0xc8], 0x480094
mov dword [ebp - 0xc4], 0x48008c
mov dword [ebp - 0xc0], 0x480078
mov dword [ebp - 0xbc], 0x480070
mov dword [ebp - 0xb8], 0x48005c
mov dword [ebp - 0xb4], 0x480054
mov dword [ebp - 0xb0], 0x48003c
mov dword [ebp - 0xac], 0x480038
mov dword [ebp - 0xa8], 0x480028
mov dword [ebp - 0xa4], 0x48001c
mov dword [ebp - 0xa0], 0x480004
mov dword [ebp - 0x9c], 0x47fff8
mov dword [ebp - 0x98], 0x47ffe0
mov dword [ebp - 0x94], str._bA__f_r
mov dword [ebp - 0x90], 0x47ffb8
mov dword [ebp - 0x8c], 0x47ffac
mov dword [ebp - 0x88], 0x47ff94
mov dword [ebp - 0x84], 0x47ff84
mov dword [ebp - 0x80], 0x47ff68
mov dword [ebp - 0x7c], 0x47ff54
mov dword [ebp - 0x78], 0x47ff3c
mov dword [ebp - 0x74], 0x47ff2c
mov dword [ebp - 0x70], 0x47ff10
mov dword [ebp - 0x6c], 0x47ff00
mov dword [ebp - 0x68], 0x47fee4
mov dword [ebp - 0x64], 0x47fed0
mov dword [ebp - 0x60], 0x47feb0
mov dword [ebp - 0x5c], 0x47fea4
mov dword [ebp - 0x58], 0x47fe8c
mov dword [ebp - 0x54], 0x47fe74
mov dword [ebp - 0x50], 0x47fe50
mov dword [ebp - 0x4c], 0x47fe40
mov dword [ebp - 0x44], 0x47fe2c
mov dword [ebp - 0x3c], 0x47fe20
mov dword [ebp - 0x38], 0x47fe08
mov dword [ebp - 0x34], 0x47fdf8
mov dword [ebp - 0x30], 0x47fddc
mov dword [ebp - 0x2c], 0x47fdcc
mov dword [ebp - 0x28], 0x47fdb0
mov dword [ebp - 0x24], 0x47fda4
mov dword [ebp - 0x20], 0x47fd8c
mov dword [ebp - 0x1c], 0x47fd80
mov dword [ebp - 0x18], 0x47fd68
mov dword [ebp - 0x14], 0x47fd5c
mov dword [ebp - 0x10], 0x47fd44
call fcn.00401da4
mov ecx, dword [ebp - 4]
add esp, 0x14
neg eax
sbb eax, eax
xor ecx, ebp
neg eax
call fcn.0043cac0
leave
ret
Function at 0x414609
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xcc
mov eax, dword [0x4a4fec]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, 0x4800b8
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x40], eax
mov eax, 0x47fd28
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
movzx eax, byte [ebp + 8]
push eax
push 0x4a93b8
push 0x47fce4
lea eax, [ebp - 0xcc]
push 0x18
push eax
mov dword [ebp - 0xcc], 0x4800ac
mov dword [ebp - 0xc8], 0x480094
mov dword [ebp - 0xc4], 0x48008c
mov dword [ebp - 0xc0], 0x480078
mov dword [ebp - 0xbc], 0x480070
mov dword [ebp - 0xb8], 0x48005c
mov dword [ebp - 0xb4], 0x480054
mov dword [ebp - 0xb0], 0x48003c
mov dword [ebp - 0xac], 0x480038
mov dword [ebp - 0xa8], 0x480028
mov dword [ebp - 0xa4], 0x48001c
mov dword [ebp - 0xa0], 0x480004
mov dword [ebp - 0x9c], 0x47fff8
mov dword [ebp - 0x98], 0x47ffe0
mov dword [ebp - 0x94], str._bA__f_r
mov dword [ebp - 0x90], 0x47ffb8
mov dword [ebp - 0x8c], 0x47ffac
mov dword [ebp - 0x88], 0x47ff94
mov dword [ebp - 0x84], 0x47ff84
mov dword [ebp - 0x80], 0x47ff68
mov dword [ebp - 0x7c], 0x47ff54
mov dword [ebp - 0x78], 0x47ff3c
mov dword [ebp - 0x74], 0x47ff2c
mov dword [ebp - 0x70], 0x47ff10
mov dword [ebp - 0x6c], 0x47ff00
mov dword [ebp - 0x68], 0x47fee4
mov dword [ebp - 0x64], 0x47fed0
mov dword [ebp - 0x60], 0x47feb0
mov dword [ebp - 0x5c], 0x47fea4
mov dword [ebp - 0x58], 0x47fe8c
mov dword [ebp - 0x54], 0x47fe74
mov dword [ebp - 0x50], 0x47fe50
mov dword [ebp - 0x4c], 0x47fe40
mov dword [ebp - 0x44], 0x47fe2c
mov dword [ebp - 0x3c], 0x47fe20
mov dword [ebp - 0x38], 0x47fe08
mov dword [ebp - 0x34], 0x47fdf8
mov dword [ebp - 0x30], 0x47fddc
mov dword [ebp - 0x2c], 0x47fdcc
mov dword [ebp - 0x28], 0x47fdb0
mov dword [ebp - 0x24], 0x47fda4
mov dword [ebp - 0x20], 0x47fd8c
mov dword [ebp - 0x1c], 0x47fd80
mov dword [ebp - 0x18], 0x47fd68
mov dword [ebp - 0x14], 0x47fd5c
mov dword [ebp - 0x10], 0x47fd44
call fcn.0041458f
mov ecx, dword [ebp - 4]
add esp, 0x14
neg eax
sbb eax, eax
xor ecx, ebp
neg eax
call fcn.0044f2ab
leave
ret
Function at 0x426df4
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xcc
mov eax, dword [0x4a4fec]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, 0x4800b8
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x40], eax
mov eax, 0x47fd28
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
movzx eax, byte [ebp + 8]
push eax
push 0x4a93b8
push 0x47fce4
lea eax, [ebp - 0xcc]
push 0x18
push eax
mov dword [ebp - 0xcc], 0x4800ac
mov dword [ebp - 0xc8], 0x480094
mov dword [ebp - 0xc4], 0x48008c
mov dword [ebp - 0xc0], 0x480078
mov dword [ebp - 0xbc], 0x480070
mov dword [ebp - 0xb8], 0x48005c
mov dword [ebp - 0xb4], 0x480054
mov dword [ebp - 0xb0], 0x48003c
mov dword [ebp - 0xac], 0x480038
mov dword [ebp - 0xa8], 0x480028
mov dword [ebp - 0xa4], 0x48001c
mov dword [ebp - 0xa0], 0x480004
mov dword [ebp - 0x9c], 0x47fff8
mov dword [ebp - 0x98], 0x47ffe0
mov dword [ebp - 0x94], str._bA__f_r
mov dword [ebp - 0x90], 0x47ffb8
mov dword [ebp - 0x8c], 0x47ffac
mov dword [ebp - 0x88], 0x47ff94
mov dword [ebp - 0x84], 0x47ff84
mov dword [ebp - 0x80], 0x47ff68
mov dword [ebp - 0x7c], 0x47ff54
mov dword [ebp - 0x78], 0x47ff3c
mov dword [ebp - 0x74], 0x47ff2c
mov dword [ebp - 0x70], 0x47ff10
mov dword [ebp - 0x6c], 0x47ff00
mov dword [ebp - 0x68], 0x47fee4
mov dword [ebp - 0x64], 0x47fed0
mov dword [ebp - 0x60], 0x47feb0
mov dword [ebp - 0x5c], 0x47fea4
mov dword [ebp - 0x58], 0x47fe8c
mov dword [ebp - 0x54], 0x47fe74
mov dword [ebp - 0x50], 0x47fe50
mov dword [ebp - 0x4c], 0x47fe40
mov dword [ebp - 0x44], 0x47fe2c
mov dword [ebp - 0x3c], 0x47fe20
mov dword [ebp - 0x38], 0x47fe08
mov dword [ebp - 0x34], 0x47fdf8
mov dword [ebp - 0x30], 0x47fddc
mov dword [ebp - 0x2c], 0x47fdcc
mov dword [ebp - 0x28], 0x47fdb0
mov dword [ebp - 0x24], 0x47fda4
mov dword [ebp - 0x20], 0x47fd8c
mov dword [ebp - 0x1c], 0x47fd80
mov dword [ebp - 0x18], 0x47fd68
mov dword [ebp - 0x14], 0x47fd5c
mov dword [ebp - 0x10], 0x47fd44
call fcn.00426d7a
mov ecx, dword [ebp - 4]
add esp, 0x14
neg eax
sbb eax, eax
xor ecx, ebp
neg eax
call fcn.00461a96
leave
ret

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
push 4
nop
nop
nop
pop edi
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
nop
je 0x433072
nop
nop
mov ebx, 0x40de38
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x5dea665d
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x433060
nop
mov eax, section..data
nop
nop
nop
cmp eax, 0
nop
nop
nop
je 0x4330d2
nop
nop
nop
mov ebx, 0x4304d8
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
push eax
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x2f184786
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
add eax, edi
nop
loop 0x4330c0
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x431219
Function at 0x459e50
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x37000]
mov dword [edi + 0x384b4], 0x6a2333a2
push edi
or ebp, 0xffffffff
jmp 0x459e7a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x459e81
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x459e70
mov eax, 1
add ebx, ebx
jne 0x459e93
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x459ea4
jne 0x459eb4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x459eb4
dec eax
add ebx, ebx
jne 0x459eb0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x459e88
xor ecx, ecx
sub eax, 3
jb 0x459ecc
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x459f3e
sar eax, 1
mov ebp, eax
jmp 0x459ed7
add ebx, ebx
jne 0x459ed7
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x459ee4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x459f08
inc ecx
add ebx, ebx
jne 0x459ef4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x459ee9
jne 0x459f05
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x459ee9
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x459f28
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x459f19
jmp 0x459e76
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x459f28
add edi, ecx
jmp 0x459e76
pop esi
mov edi, esi
mov ecx, 0x1b8e
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x459f46
cmp byte [edi], 0xd
jne 0x459f46
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov eax, ebx
loop 0x459f4b
lea edi, [esi + 0x56000]
mov eax, dword [edi]
or eax, eax
je 0x459fba
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x59ad0]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x59b84]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x459f78
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x59b88]
or eax, eax
je 0x459fb4
mov dword [ebx], eax
add ebx, 4
jmp 0x459f95
call dword [esi + 0x59b8c]
popal
jmp 0x43721c