joyce8/EMBER2024-capa huggingface dataset:
Function at 0x402220
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x42c014]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
mov esi, ecx
push edi
cmp dword [esi + 0x28], 0
je 0x40229b
cmp dword [esi + 0x34], 0
je 0x40229b
push 0
push 0x80
push 2
push 0
push 1
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x40229b
push 0
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
push eax
push dword [esi + 0x34]
push dword [esi + 0x28]
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
mov eax, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00409a47
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
xor ecx, ebp
pop esi
call fcn.00409a47
mov esp, ebp
pop ebp
ret 4

Function at 0x402a50
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x42c014]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, dword [edx + 8]
test edi, edi
je 0x402aa9
mov esi, dword [edx + 0xc]
test esi, 0x2000000
je 0x402abe
mov esi, dword [edx]
cmp esi, dword [edx + 4]
jne 0x402aa9
cmp dword [edx + 0x10], 0
push ebx
jne 0x402a96
mov eax, dword [ecx]
mov ebx, dword [ecx + 0x3c]
cmp dword [eax + 0x38], ebx
je 0x402a96
xor edx, edx
mov eax, edi
div ebx
test edx, edx
jne 0x402aa8
push dword [ecx + 0x34]
mov eax, dword [ecx + 0x20]
push 0x4000
push edi
push esi
call eax
add esp, 0x10
pop ebx
pop edi
mov eax, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00409a47
mov esp, ebp
pop ebp
ret
mov ecx, esi
mov eax, esi
shr eax, 0x1e
and eax, 1
shr ecx, 0x1d
and ecx, 1
lea ecx, [eax + ecx*2]
mov eax, esi
shr eax, 0x1f
lea eax, [eax + ecx*2]
mov ecx, dword [eax*4 + 0x429280]
lea eax, [ebp - 8]
push eax
mov eax, ecx
or eax, 0x200
test esi, 0x4000000
cmove eax, ecx
push eax
push edi
push dword [edx]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x402aa9
push eax
push eax
lea eax, [ebp - 0xc]
push eax
push 0x400
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0
push 0x1300
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
mov ecx, dword [ebp - 0xc]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x402b27
sub ecx, edx
lea eax, [ecx + 0x1f]
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
push dword [ebp - 0xc]
mov esi, eax
push str.Error_protecting_memory_page
push str._s:__s
push esi
call fcn.004029e0
add esp, 0x10
push esi
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_LocalFree]
call esi
push dword [ebp - 0xc]
call esi
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
xor ecx, ebp
pop esi
call fcn.00409a47
mov esp, ebp
pop ebp
ret
Function at 0x4038e0
Capabilities:
Get geographical location
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x41d702
mov eax, dword fs:[0]
push eax
sub esp, 0x624
mov eax, dword [0x42c014]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x608], esi
mov dword [ebp - 0x630], esi
xorps xmm0, xmm0
mov dword [ebp - 0x60c], 0
movq qword [esi], xmm0
mov dword [esi + 8], 0
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
lea eax, [ebp - 0x604]
mov dword [ebp - 4], 0
push eax
push 0x400
mov dword [ebp - 0x60c], 1
call dword [sym.imp.USER32.dll_GetKeyboardLayoutList]
xor edi, edi
mov dword [ebp - 0x608], eax
test eax, eax
jle 0x403a89
nop word [eax + eax]
movzx eax, word [ebp + edi*4 - 0x604]
lea ecx, [ebp - 0x204]
push 0x1f4
push ecx
push 2
push eax
mov dword [ebp - 0x610], eax
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
lea eax, [ebp - 0x204]
mov dword [ebp - 0x62c], 0
mov dword [ebp - 0x61c], 0
lea edx, [eax + 1]
mov dword [ebp - 0x618], 0
nop word [eax + eax]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4039d0
sub eax, edx
lea ecx, [ebp - 0x62c]
push eax
lea eax, [ebp - 0x204]
push eax
call fcn.00402760
mov edx, dword [ebp - 0x610]
mov dword [ebp - 0x614], edx
mov dword [ebp - 4], 1
mov eax, dword [esi + 4]
cmp eax, dword [esi + 8]
je 0x403a33
movups xmm0, xmmword [ebp - 0x62c]
mov ecx, 0xf
mov byte [ebp - 0x62c], 0
movups xmmword [eax], xmm0
movq xmm0, qword [ebp - 0x61c]
movq qword [eax + 0x10], xmm0
mov dword [eax + 0x18], edx
add dword [esi + 4], 0x1c
jmp 0x403a48
lea ecx, [ebp - 0x62c]
push ecx
push eax
mov ecx, esi
call fcn.004093f0
mov ecx, dword [ebp - 0x618]
mov byte [ebp - 4], 0
cmp ecx, 0x10
jb 0x403a7c
mov edx, dword [ebp - 0x62c]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x403a72
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x403aa6
push ecx
push edx
call fcn.00409bac
add esp, 8
inc edi
cmp edi, dword [ebp - 0x608]
jl 0x403980
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00409a47
mov esp, ebp
pop ebp
ret
call fcn.0040d01f
int3
Function at 0x4058f0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x42c014]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 0x1c], 0x10
lea ecx, [ebp - 8]
push ecx
lea ecx, [ebp - 0xc]
push ecx
push 0
push 0
push 0
push 0
lea eax, [ebp + 8]
cmovae eax, dword [ebp + 8]
push 0
push eax
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
cmp dword [ebp + 0x1c], 0x10
lea ecx, [ebp - 0xc]
push ecx
push 0x20006
lea eax, [ebp + 8]
cmovae eax, dword [ebp + 8]
push 0
push eax
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push dword [ebp + 0x48]
cmp dword [ebp + 0x4c], 0x10
lea ecx, [ebp + 0x38]
lea eax, [ebp + 0x20]
cmovae ecx, dword [ebp + 0x38]
cmp dword [ebp + 0x34], 0x10
push ecx
cmovae eax, dword [ebp + 0x20]
push 1
push 0
push eax
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp + 0x1c]
cmp ecx, 0x10
jb 0x4059b0
mov edx, dword [ebp + 8]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x4059a6
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x405a42
push ecx
push edx
call fcn.00409bac
add esp, 8
mov ecx, dword [ebp + 0x34]
mov dword [ebp + 0x18], 0
mov dword [ebp + 0x1c], 0xf
mov byte [ebp + 8], 0
cmp ecx, 0x10
jb 0x4059f2
mov edx, dword [ebp + 0x20]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x4059e8
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x405a42
push ecx
push edx
call fcn.00409bac
add esp, 8
mov ecx, dword [ebp + 0x4c]
mov dword [ebp + 0x30], 0
mov dword [ebp + 0x34], 0xf
mov byte [ebp + 0x20], 0
cmp ecx, 0x10
jb 0x405a34
mov edx, dword [ebp + 0x38]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x405a2a
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x405a42
push ecx
push edx
call fcn.00409bac
add esp, 8
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00409a47
mov esp, ebp
pop ebp
ret
call fcn.0040d01f
int3

Function at 0x408870
Capabilities:
Encode data using xor

Disassembly:
cmp byte [ecx + 0x5e], 0
je 0x4088bd
movups xmm0, xmmword [ecx]
mov eax, 0x40
movaps xmm2, xmmword [str.................]
movaps xmm1, xmm2
pxor xmm1, xmm0
movups xmmword [ecx], xmm1
movups xmm0, xmmword [ecx + 0x10]
pxor xmm0, xmm2
movups xmmword [ecx + 0x10], xmm0
movups xmm0, xmmword [ecx + 0x20]
pxor xmm0, xmm2
movups xmmword [ecx + 0x20], xmm0
movups xmm0, xmmword [ecx + 0x30]
pxor xmm0, xmm2
movups xmmword [ecx + 0x30], xmm0
xor byte [eax + ecx], 0x2e
inc eax
cmp eax, 0x5f
jb 0x4088b3
mov eax, ecx
ret

Function at 0x4089d0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [ecx + 0xc], 0
je 0x4089e2
xor eax, eax
xor byte [eax + ecx], 0x2e
inc eax
cmp eax, 0xd
jb 0x4089d8
mov eax, ecx
ret
Function at 0x40a70e
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x40a74d
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x40a74d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x40a74d
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x40a74d
cmp dword [ecx + 0x74], 0xe
jbe 0x40a74d
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x413558
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x422940
push 0x422938
push str.FlsAlloc
push 0x1f
call fcn.00413474
mov esi, eax
add esp, 0x10
test esi, esi
je 0x41358c
push dword [ebp + 8]
mov ecx, esi
call dword [0x41f1d4]
call esi
jmp 0x413592
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x4135d6
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x422950
push 0x422948
push str.FlsGetValue
push 0x21
call fcn.00413474
mov esi, eax
add esp, 0x10
test esi, esi
je 0x41360d
push dword [ebp + 8]
mov ecx, esi
call dword [0x41f1d4]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x413615
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x422958
push 0x422950
push str.FlsSetValue
push 0x22
call fcn.00413474
mov esi, eax
add esp, 0x10
test esi, esi
je 0x41364f
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x41f1d4]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x4184b5
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x418552
push ebx
push esi
call fcn.0041847e
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.00414fc8
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x4184ff
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x418551
push edi
push eax
call fcn.00413ce9
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x41851f
call fcn.00413321
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x418550
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.00414fc8
add esp, 0x20
test eax, eax
jne 0x41853e
push edi
call fcn.00413321
jmp 0x418546
push ebx
call fcn.00413321
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret
Function at 0x41d110
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x41d13d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x41d13d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x409132
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, esp
push ecx
push ecx
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0x1c
test byte [0x432040], 0x20
push esi
push edi
mov esi, ecx
je 0x409173
push dword [ebx + 0xc]
push dword [ebx + 8]
push 0x428d88
push dword [0x43204c]
push dword [0x432048]
call fcn.0040be9f
push 0x1c135e
call fcn.00402d04
lea eax, [esi + 8]
mov ecx, dword [eax]
mov esi, ecx
mov edi, dword [eax + 4]
mov edx, edi
mov dword [ebp - 4], eax
mov eax, ecx
shr eax, 0xc
dec eax
mov dword [ebp - 0x10], esi
shl eax, 0xc
xor eax, ecx
and eax, 0x7f000
xor ecx, eax
mov eax, esi
mov esi, dword [ebp - 4]
push ebx
mov ebx, ecx
mov ecx, edi
lock cmpxchg8b qword [esi]
pop ebx
mov ecx, edx
cmp eax, dword [ebp - 0x10]
jne 0x4091bb
cmp ecx, edi
je 0x4091eb
mov esi, eax
mov dword [ebp - 0x10], ecx
shr esi, 0xc
mov edi, eax
dec esi
mov edx, ecx
shl esi, 0xc
xor esi, eax
and esi, 0x7f000
xor esi, eax
push ebx
mov ebx, esi
mov esi, dword [ebp - 4]
lock cmpxchg8b qword [esi]
pop ebx
mov ecx, edx
cmp eax, edi
jne 0x4091bb
cmp ecx, dword [ebp - 0x10]
jne 0x4091bb
pop edi
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 0xc

Function at 0x416b50
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebx
push ebp
push esi
push edi
mov edi, eax
mov edx, 0x220
or ecx, 0xffffffff
mov esi, edi
movzx eax, byte [esi]
xor eax, ecx
and eax, 0xff
shr ecx, 8
xor ecx, dword [eax*4 + fcn.00413050]
inc esi
dec edx
jne 0x416b62
mov ebp, dword [edi + 0x224]
lea ebx, [ecx + ebp]
test ebp, ebp
je 0x416bc3
mov edi, dword [edi + 0x220]
lea ecx, [ecx]
mov edx, 0xb3c
or ecx, 0xffffffff
mov esi, edi
lea ebx, [ebx]
movzx eax, byte [esi]
xor eax, ecx
and eax, 0xff
shr ecx, 8
xor ecx, dword [eax*4 + fcn.00413050]
inc esi
dec edx
jne 0x416ba0
add ebx, ecx
add edi, 0xb3c
dec ebp
jne 0x416b90
pop edi
pop esi
pop ebp
mov eax, ebx
pop ebx
ret

Function at 0x416d80
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push esi
mov edx, 0x68
or eax, 0xffffffff
mov esi, ecx
lea ecx, [ecx]
movzx ecx, byte [esi]
xor ecx, eax
and ecx, 0xff
shr eax, 8
xor eax, dword [ecx*4 + fcn.00413050]
inc esi
dec edx
jne 0x416d90
pop esi
ret
Function at 0x41f5f0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x18
push ebx
mov ebx, dword [esp + 0x20]
mov eax, dword [ebx + 8]
push ebp
push esi
lea edx, [eax*8 + 8]
xor ebp, ebp
or ecx, 0xffffffff
push edi
mov dword [esp + 0x10], 0
lea esi, [ebx + 8]
test edx, edx
je 0x41f638
lea esp, [esp]
movzx eax, byte [esi]
xor eax, ecx
and eax, 0xff
shr ecx, 8
xor ecx, dword [eax*4 + fcn.00413050]
inc esi
dec edx
jne 0x41f620
mov eax, dword [ebx + 4]
cmp ecx, eax
je 0x41f66e
or dword [0x415054], 0x20000400
push eax
push ecx
mov dword [ebx + 8], ebp
mov dword [ebx], ebp
push 0x412d80
push 1
mov ebx, 0x415428
call fcn.00416e70
add esp, 0x10
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret 4
mov esi, dword [ebx]
mov dword [ebx], ebp
test esi, esi
je 0x41f7d6
lea ebx, [ebx]
mov eax, ebp
inc ebp
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov dword [esp + 0x14], ebp
cmp eax, 0x400
jae 0x41f7b7
lea eax, [esp + 0x18]
push eax
mov edi, 0x10
mov ecx, 0x419860
call fcn.00417db0
test eax, eax
je 0x41f79b
mov eax, dword [esp + 0x20]
cmp eax, 0x1000
ja 0x41f776
lea edi, [eax*8 + 0x10]
push edi
call dword [fcn.0040d1ec]
mov ebp, eax
add esp, 4
test ebp, ebp
je 0x41f75b
push ebp
mov ecx, 0x419860
call fcn.00417db0
test eax, eax
je 0x41f74b
mov eax, ebp
call fcn.0041f7f0
mov ecx, dword [ebp + 4]
cmp eax, ecx
jne 0x41f72b
mov dword [ebx], ebp
mov eax, dword [ebp]
mov dword [esp + 0x2c], ebp
mov dword [ebp], 0
mov ebp, dword [esp + 0x14]
mov dword [esp + 0x10], eax
jmp 0x41f79f
or dword [0x415054], 0x20000400
push ecx
push eax
push 0x412eb0
push 1
mov ebx, 0x415428
call fcn.00416e70
add esp, 0x10
push ebp
call dword [fcn.0040d204]
mov ebp, dword [esp + 0x18]
add esp, 4
jmp 0x41f79b
push edi
push 0x412a10
push 1
mov ebx, 0x415428
call fcn.00416e70
mov ebp, dword [esp + 0x20]
add esp, 0xc
jmp 0x41f79b
or dword [0x415054], 0x20000800
push 0x1000
push eax
push esi
push 0x412f48
push 1
mov ebx, 0x415428
call fcn.00416e70
add esp, 0x14
mov eax, dword [esp + 0x10]
mov ebx, dword [esp + 0x2c]
mov esi, eax
test eax, eax
jne 0x41f680
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret 4
or dword [0x415054], 0x20000800
push ebp
push 0x412e08
push 1
mov ebx, 0x415428
call fcn.00416e70
add esp, 0xc
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret 4

Function at 0x41f7f0
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push esi
lea esi, [eax + 8]
mov eax, dword [esi]
lea edx, [eax*8 + 8]
or eax, 0xffffffff
test edx, edx
je 0x41f829
jmp 0x41f810
movzx ecx, byte [esi]
xor ecx, eax
and ecx, 0xff
shr eax, 8
xor eax, dword [ecx*4 + fcn.00413050]
inc esi
dec edx
jne 0x41f810
pop esi
ret

Function at 0x41f830
Capabilities:
Encode data using xor

Disassembly:
test edx, edx
je 0x41f87b
mov ecx, edx
push esi
lea esi, [ecx + 2]
lea ebx, [ebx]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x41f840
sub ecx, esi
sar ecx, 1
lea esi, [ecx + ecx]
or eax, 0xffffffff
test esi, esi
je 0x41f879
lea esp, [esp]
movzx ecx, byte [edx]
xor ecx, eax
and ecx, 0xff
shr eax, 8
xor eax, dword [ecx*4 + fcn.00413050]
inc edx
dec esi
jne 0x41f860
pop esi
ret
xor eax, eax
ret
Function at 0x480aa0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x4d000]
push edi
jmp 0x480aba
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x480ac1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x480ab0
mov eax, 1
add ebx, ebx
jne 0x480ad3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x480ae4
jne 0x480b03
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x480b03
dec eax
add ebx, ebx
jne 0x480af0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x480ac8
add ebx, ebx
jne 0x480aff
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x480b55
xor ecx, ecx
sub eax, 3
jb 0x480b1b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x480b8a
sar eax, 1
mov ebp, eax
jmp 0x480b26
add ebx, ebx
jne 0x480b26
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x480af4
inc ecx
add ebx, ebx
jne 0x480b34
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x480af4
add ebx, ebx
jne 0x480b41
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x480b36
jne 0x480b52
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x480b36
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x480b74
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x480b66
jmp 0x480ab6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x480b74
add edi, ecx
jmp 0x480ab6
pop esi
mov edi, esi
mov ecx, 0x3355
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x480b92
cmp byte [edi], 0x1b
jne 0x480b92
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x480b97
lea edi, [esi + 0x7d000]
mov eax, dword [edi]
or eax, eax
je 0x480c0f
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x84aec]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x84bb4]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x480bc4
mov ecx, edi
jns 0x480bf3
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x84bb8]
or eax, eax
je 0x480c09
mov dword [ebx], eax
add ebx, 4
jmp 0x480be1
call dword [esi + 0x84bc8]
mov ebp, dword [esi + 0x84bbc]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x21f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x480c43
sub esp, 0xffffff80
jmp 0x44056b
Function at 0x4013da
Capabilities:
Execute command

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov edx, 0x440004
call fcn.004018f0
and esp, 0xfffffff0
mov eax, 0
add eax, 0xf
add eax, 0xf
shr eax, 4
shl eax, 4
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
call fcn.0040d970
call fcn.00401280
call fcn.0040d5b0
fld qword [0x441010]
fstp qword [ebp - 8]
fldz
fstp qword [ebp - 0x10]
fld qword [ebp - 8]
fdiv qword [ebp - 0x10]
fstp qword [ebp - 0x18]
fld qword [ebp - 8]
fdiv qword [ebp - 0x10]
fstp qword [ebp - 0x20]
fld qword [ebp - 0x20]
fstp qword [esp + 4]
mov dword [esp], 0x444400
call fcn.0042b1e0
mov dword [esp + 4], str.
mov dword [esp], eax
call fcn.0043ca20
fld qword [ebp - 0x18]
fstp qword [esp + 4]
mov dword [esp], eax
call fcn.0042b1e0
mov dword [esp], str.PAUSE
call sub.msvcrt.dll_system
mov eax, 0
leave
ret
Function at 0x401b10
Capabilities:
Create thread
Terminate thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov dword [ebp - 8], esi
mov esi, dword [ebp + 0x18]
mov dword [ebp - 0xc], ebx
mov ebx, dword [ebp + 0x10]
cmp esi, 0x10000
mov dword [ebp - 4], edi
ja 0x401d07
mov edx, dword [ebp + 8]
mov eax, dword [edx + 4]
test eax, eax
jne 0x401b57
mov edx, dword [ebp + 8]
mov eax, dword [edx]
test eax, eax
jne 0x401b90
xor eax, eax
test esi, esi
jne 0x401bb0
mov ebx, dword [ebp - 0xc]
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
mov dword [esp], eax
xor edi, edi
mov dword [esp + 4], edi
call sub.KERNEL32.dll_TerminateThread
mov ecx, dword [ebp + 8]
sub esp, 8
mov eax, dword [ecx + 4]
mov dword [esp], eax
call sub.KERNEL32.dll_CloseHandle
mov edx, dword [ebp + 8]
sub esp, 4
mov eax, dword [edx]
test eax, eax
je 0x401b44
lea esi, [esi]
lea edi, [edi]
mov dword [esp], eax
call sub.KERNEL32.dll_CloseHandle
sub esp, 4
xor eax, eax
test esi, esi
je 0x401b4a
jmp 0x401bb0
mov dword [esp + 8], ebx
xor ecx, ecx
shr ebx, 1
mov dword [esp + 4], ecx
mov edx, dword [ebp + 0xc]
mov dword [esp], edx
call sub.msvcrt.dll_memset
cld
mov edi, dword [ebp + 8]
xor eax, eax
mov ecx, 6
xor edx, edx
rep stosd dword es:[edi], eax
mov edi, dword [ebp + 0xc]
mov eax, ebx
mov ecx, dword [ebp + 0x14]
shl eax, 0x10
mov dword [0x444048], edi
xor edi, edi
shld edi, ebx, 0x10
mov dword [0x44404c], ecx
mov dword [esp + 8], esi
mov dword [esp + 4], edi
xor edi, edi
mov dword [esp + 0xc], edx
mov dword [esp], eax
call fcn.0040d9a0
mov dword [0x444054], esi
mov ebx, dword [ebp + 0x14]
add eax, eax
add eax, ebx
mov dword [0x444050], eax
call sub.KERNEL32.dll_GetCurrentProcess
mov esi, eax
call sub.KERNEL32.dll_GetCurrentThread
mov ebx, eax
call sub.KERNEL32.dll_GetCurrentProcess
mov dword [esp + 0x10], edi
xor edx, edx
mov ecx, 2
mov dword [esp + 0x18], ecx
mov dword [esp + 0x14], edx
mov ecx, dword [ebp + 8]
mov dword [esp + 8], esi
mov dword [esp + 4], ebx
mov dword [esp + 0xc], ecx
mov dword [esp], eax
call sub.KERNEL32.dll_DuplicateHandle
sub esp, 0x1c
test eax, eax
jne 0x401c80
call sub.msvcrt.dll__errno
mov dword [eax], 3
mov eax, 0xffffffff
mov ebx, dword [ebp - 0xc]
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
xor esi, esi
lea ebx, [ebp - 0x10]
mov edx, 0x401a60
mov dword [esp + 0x14], ebx
xor eax, eax
mov ebx, 0xf
mov dword [esp + 0x10], esi
mov ecx, dword [ebp + 8]
mov dword [esp + 8], edx
mov dword [esp + 4], eax
mov dword [esp + 0xc], ecx
mov dword [esp], 0
call sub.KERNEL32.dll_CreateThread
mov edi, dword [ebp + 8]
sub esp, 0x18
mov dword [edi + 4], eax
mov dword [esp + 4], ebx
mov dword [esp], eax
call sub.KERNEL32.dll_SetThreadPriority
mov edx, dword [ebp + 8]
sub esp, 8
xor eax, eax
mov esi, dword [edx + 4]
test esi, esi
jne 0x401b4a
mov eax, dword [edx]
mov dword [esp], eax
call sub.KERNEL32.dll_CloseHandle
mov edi, dword [ebp + 8]
sub esp, 4
mov dword [edi], 0
call sub.msvcrt.dll__errno
mov dword [eax], 0xb
mov eax, 0xffffffff
jmp 0x401c6f
call sub.msvcrt.dll__errno
mov dword [eax], 0x16
mov eax, 0xffffffff
jmp 0x401c6f