joyce8/EMBER2024-capa huggingface dataset:
Function at 0x416822
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x258
push ebx
push esi
mov esi, eax
lea eax, [ebp - 0x2c]
push eax
push dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 0x2c], ebx
call sub.VERSION.dll_GetFileVersionInfoSizeW
cmp eax, ebx
mov dword [ebp - 4], eax
jbe 0x4169f8
lea eax, [esi + 0x18]
mov dword [ebp - 0x30], eax
mov word [eax], bx
lea eax, [esi + 0x218]
mov dword [ebp - 0x1c], eax
mov word [eax], bx
lea eax, [esi + 0x418]
mov dword [ebp - 8], eax
mov word [eax], bx
lea eax, [esi + 0x618]
mov dword [ebp - 0xc], eax
mov word [eax], bx
lea eax, [esi + 0x818]
mov dword [ebp - 0x10], eax
mov word [eax], bx
lea eax, [esi + 0xa18]
mov dword [ebp - 0x18], eax
mov word [eax], bx
lea eax, [esi + 0xc18]
push edi
push dword [ebp - 4]
mov dword [ebp - 0x20], eax
mov word [eax], bx
lea eax, [esi + 0xe18]
mov dword [ebp - 0x28], eax
mov word [eax], bx
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
pop ecx
mov edi, eax
push edi
push dword [ebp - 4]
push ebx
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoW
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
push 0x41c794
push edi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x4168fe
mov eax, dword [ebp - 0x24]
mov ecx, dword [eax + 0x30]
mov dword [esi + 4], ecx
mov ecx, dword [eax + 8]
mov dword [esi], ecx
mov ecx, dword [eax + 0x14]
mov dword [esi + 0xc], ecx
mov ecx, dword [eax + 0x10]
mov dword [esi + 8], ecx
mov ecx, dword [eax + 0x24]
mov dword [esi + 0x10], ecx
mov eax, dword [eax + 0x28]
mov dword [esi + 0x14], eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x14]
push eax
push str.VarFileInfoTranslation
push edi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x41694d
mov eax, dword [ebp - 0x14]
movzx ecx, word [eax + 2]
movzx eax, word [eax]
push ecx
push eax
push str._4.4X_4.4X
lea eax, [ebp - 0x58]
push 0x14
push eax
call sub.msvcrt.dll__snwprintf
add esp, 0x14
push 0x41b5e0
lea eax, [ebp - 0x58]
push eax
push edi
lea esi, [ebp - 0x258]
call fcn.00416793
test eax, eax
jne 0x41695d
lea eax, [ebp - 0x58]
push str.040904E4
push eax
call sub.msvcrt.dll_wcscpy
pop ecx
pop ecx
mov esi, dword [ebp - 0x30]
push 0x41dcb4
lea eax, [ebp - 0x58]
push eax
push edi
call fcn.00416793
mov esi, dword [ebp - 0x1c]
push 0x41dccc
lea eax, [ebp - 0x58]
push eax
push edi
call fcn.00416793
mov esi, dword [ebp - 8]
push 0x41dcec
lea eax, [ebp - 0x58]
push eax
push edi
call fcn.00416793
mov esi, dword [ebp - 0xc]
push 0x41dd04
lea eax, [ebp - 0x58]
push eax
push edi
call fcn.00416793
mov esi, dword [ebp - 0x10]
push 0x41dd24
lea eax, [ebp - 0x58]
push eax
push edi
call fcn.00416793
mov esi, dword [ebp - 0x18]
push 0x41dd3c
lea eax, [ebp - 0x58]
push eax
push edi
call fcn.00416793
mov esi, dword [ebp - 0x20]
push 0x41dd58
lea eax, [ebp - 0x58]
push eax
push edi
call fcn.00416793
mov esi, dword [ebp - 0x28]
push str.OriginalFileName
lea eax, [ebp - 0x58]
push eax
push edi
call fcn.00416793
xor ebx, ebx
push edi
inc ebx
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
pop ecx
pop edi
pop esi
mov eax, ebx
pop ebx
leave
ret 4
Function at 0x41a470
Capabilities:
Parse pe header
Terminate process

Disassembly:
push 0x70
push 0x41b500
call fcn.0041a680
xor edi, edi
push edi
call dword [sym.imp.KERNEL32.DLL_GetModuleHandleA]
cmp word [eax], 0x5a4d
jne 0x41a4ab
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x41a4ab
movzx eax, word [ecx + 0x18]
cmp eax, 0x10b
je 0x41a4c3
cmp eax, 0x20b
je 0x41a4b0
mov dword [ebp - 0x1c], edi
jmp 0x41a4d7
cmp dword [ecx + 0x84], 0xe
jbe 0x41a4ab
xor eax, eax
cmp dword [ecx + 0xf8], edi
jmp 0x41a4d1
cmp dword [ecx + 0x74], 0xe
jbe 0x41a4ab
xor eax, eax
cmp dword [ecx + 0xe8], edi
setne al
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], edi
push 2
pop ebx
push ebx
call dword [sym.imp.msvcrt.dll___set_app_type]
pop ecx
or dword [0x424a74], 0xffffffff
or dword [0x424a78], 0xffffffff
call dword [sym.imp.msvcrt.dll___p__fmode]
mov ecx, dword [0x42369c]
mov dword [eax], ecx
call dword [sym.imp.msvcrt.dll___p__commode]
mov ecx, dword [0x423698]
mov dword [eax], ecx
mov eax, dword [sym.imp.msvcrt.dll__adjust_fdiv]
mov eax, dword [eax]
mov dword [0x424a70], eax
call fcn.0040a58e
cmp dword [section..data], edi
jne 0x41a534
push fcn.0040a58e
call dword [sym.imp.msvcrt.dll___setusermatherr]
pop ecx
call fcn.0041a66c
push 0x41b4d0
push 0x41b4cc
call sub.msvcrt.dll__initterm
mov eax, dword [0x423694]
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x20]
push eax
push dword [0x423690]
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.msvcrt.dll___wgetmainargs]
mov dword [ebp - 0x30], eax
push 0x41b4c8
push 0x41b4a0
call sub.msvcrt.dll__initterm
add esp, 0x24
mov eax, dword [sym.imp.msvcrt.dll__wcmdln]
mov esi, dword [eax]
cmp esi, edi
jne 0x41a59a
or dword [ebp - 4], 0xffffffff
mov eax, 0xff
jmp 0x41a654
mov dword [ebp - 0x34], esi
cmp word [esi], 0x22
jne 0x41a5e8
add esi, ebx
mov dword [ebp - 0x34], esi
mov ax, word [esi]
cmp ax, di
je 0x41a5b6
cmp ax, 0x22
jne 0x41a5a3
cmp word [esi], 0x22
jne 0x41a5c1
add esi, ebx
mov dword [ebp - 0x34], esi
mov ax, word [esi]
cmp ax, di
je 0x41a5cf
cmp ax, 0x20
jbe 0x41a5bc
mov dword [ebp - 0x4c], edi
lea eax, [ebp - 0x78]
push eax
call dword [sym.imp.KERNEL32.DLL_GetStartupInfoW]
test byte [ebp - 0x4c], 1
je 0x41a5f5
movzx eax, word [ebp - 0x48]
jmp 0x41a5f8
cmp word [esi], 0x20
jbe 0x41a5c1
add esi, ebx
mov dword [ebp - 0x34], esi
jmp 0x41a5e8
push 0xa
pop eax
push eax
push esi
push edi
push edi
call dword [sym.imp.KERNEL32.DLL_GetModuleHandleA]
push eax
call main
mov esi, eax
mov dword [ebp - 0x7c], esi
cmp dword [ebp - 0x1c], edi
jne 0x41a619
push esi
call dword [sym.imp.msvcrt.dll_exit]
call dword [sym.imp.msvcrt.dll__cexit]
jmp 0x41a64e
or dword [ebp - 4], 0xffffffff
mov eax, esi
call fcn.0041a6b9
ret
Function at 0x4052af
Capabilities:
Set file attributes

Disassembly:
test edx, 0xf0000000
je 0x4052bd
and edx, 0x3fff
jmp fcn.00405221

Function at 0x4052c2
Capabilities:
Delete directory

Disassembly:
mov eax, 0x43c014
call fcn.0043b650
sub esp, 0xc
push ebx
push esi
push edi
mov edi, ecx
call fcn.00407f9a
mov esi, dword [sym.imp.kernel32.dll_RemoveDirectoryW]
mov ebx, eax
cmp ebx, 1
je 0x4052f1
push edi
call esi
test eax, eax
je 0x4052f1
mov al, 1
jmp 0x405335
test ebx, ebx
je 0x405333
lea ecx, [ebp - 0x18]
call fcn.00402b75
and dword [ebp - 4], 0
cmp ebx, 1
setne al
push eax
lea edx, [ebp - 0x18]
mov ecx, edi
call fcn.004080a3
test al, al
push dword [ebp - 0x18]
je 0x40532d
call esi
mov esi, eax
push dword [ebp - 0x18]
call fcn.00401c54
test esi, esi
pop ecx
setne al
jmp 0x405335
call fcn.00401c54
pop ecx
xor al, al
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x405344
Capabilities:
Move file

Disassembly:
mov eax, 0x43c030
call fcn.0043b650
sub esp, 0x24
push ebx
push esi
push edi
mov dword [ebp - 0x10], edx
mov dword [ebp - 0x18], ecx
call fcn.00407f9a
mov ecx, dword [ebp - 0x10]
mov esi, eax
call fcn.00407f9a
mov edi, dword [sym.imp.kernel32.dll_MoveFileW]
mov dword [ebp - 0x14], eax
push 1
pop ebx
cmp esi, ebx
je 0x40538d
cmp eax, ebx
je 0x40538d
push dword [ebp - 0x10]
push dword [ebp - 0x18]
call edi
test eax, eax
je 0x40538d
mov al, bl
jmp 0x405404
test esi, esi
jne 0x405396
cmp dword [ebp - 0x14], esi
je 0x405402
lea ecx, [ebp - 0x30]
call fcn.00402b75
and dword [ebp - 4], 0
lea ecx, [ebp - 0x24]
call fcn.00402b75
cmp esi, ebx
mov byte [ebp - 4], bl
je 0x4053b6
cmp dword [ebp - 0x14], ebx
jne 0x4053b8
xor ebx, ebx
mov edx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x18]
lea eax, [ebp - 0x24]
push ebx
push eax
lea eax, [ebp - 0x30]
push eax
call fcn.0040fba6
test al, al
push dword [ebp - 0x24]
je 0x4053f3
push dword [ebp - 0x30]
call edi
mov esi, eax
push dword [ebp - 0x24]
call fcn.00401c54
push dword [ebp - 0x30]
call fcn.00401c54
pop ecx
test esi, esi
pop ecx
setne al
jmp 0x405404
call fcn.00401c54
push dword [ebp - 0x30]
call fcn.00401c54
pop ecx
pop ecx
xor al, al
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x40550f
Capabilities:
Create directory

Disassembly:
mov eax, 0x43c060
call fcn.0043b650
sub esp, 0xc
push ebx
push esi
push edi
mov edi, ecx
call fcn.00407f9a
mov esi, dword [sym.imp.kernel32.dll_CreateDirectoryW]
mov ebx, eax
cmp ebx, 1
je 0x40554d
push 0
push edi
call esi
test eax, eax
je 0x405540
mov al, 1
jmp 0x405596
call dword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 0xb7
je 0x405594
test ebx, ebx
je 0x405594
lea ecx, [ebp - 0x18]
call fcn.00402b75
and dword [ebp - 4], 0
cmp ebx, 1
setne al
push eax
lea edx, [ebp - 0x18]
mov ecx, edi
call fcn.004080a3
test al, al
je 0x40558b
push 0
push dword [ebp - 0x18]
call esi
mov esi, eax
push dword [ebp - 0x18]
call fcn.00401c54
test esi, esi
pop ecx
setne al
jmp 0x405596
push dword [ebp - 0x18]
call fcn.00401c54
pop ecx
xor al, al
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x4061e0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov eax, 0x43c170
call fcn.0043b650
sub esp, 0xc
push ebx
push esi
push edi
mov edi, ecx
call fcn.00407f9a
mov esi, dword [sym.imp.kernel32.dll_GetFileAttributesW]
mov ebx, eax
cmp ebx, 1
je 0x40620c
push edi
call esi
cmp eax, 0xffffffff
jne 0x40624e
test ebx, ebx
je 0x40624b
lea ecx, [ebp - 0x18]
call fcn.00402b75
and dword [ebp - 4], 0
cmp ebx, 1
setne al
push eax
lea edx, [ebp - 0x18]
mov ecx, edi
call fcn.004080a3
test al, al
push dword [ebp - 0x18]
je 0x406245
call esi
mov esi, eax
push dword [ebp - 0x18]
call fcn.00401c54
pop ecx
mov eax, esi
jmp 0x40624e
call fcn.00401c54
pop ecx
or eax, 0xffffffff
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x406a2b
Capabilities:
Get disk information

Disassembly:
mov eax, 0x43c23c
call fcn.0043b650
sub esp, 0x20
push ebx
push esi
push edi
mov dword [ebp - 0x18], ecx
call fcn.00401553
mov edi, dword [sym.imp.kernel32.dll_GetLogicalDriveStringsW]
push 0
push 0
call edi
mov ebx, eax
test ebx, ebx
mov dword [ebp - 0x14], ebx
je 0x406af9
mov eax, SysReAllocString
cmp ebx, eax
ja 0x406a67
mov eax, ebx
add eax, eax
push eax
call fcn.0040fba6
mov esi, eax
pop ecx
mov dword [ebp - 0x20], esi
and dword [ebp - 4], 0
push esi
push ebx
call edi
mov ebx, eax
xor edi, edi
cmp ebx, edi
mov dword [ebp - 0x10], ebx
je 0x406af2
cmp ebx, dword [ebp - 0x14]
ja 0x406af2
lea ecx, [ebp - 0x2c]
call fcn.00402b75
test ebx, ebx
mov byte [ebp - 4], 1
mov dword [ebp - 0x14], edi
jbe 0x406ada
push 2
xor eax, eax
pop ebx
cmp word [esi + ebx - 2], 0
jne 0x406acf
add eax, esi
lea ecx, [ebp - 0x2c]
push eax
call fcn.0040fba6
mov ecx, dword [ebp - 0x18]
lea eax, [edi + 1]
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x2c]
push eax
mov dword [ebp - 0x1c], ebx
call fcn.0040150c
mov eax, ebx
inc edi
inc ebx
inc ebx
cmp edi, dword [ebp - 0x10]
jb 0x406aa5
mov ebx, dword [ebp - 0x10]
push dword [ebp - 0x2c]
call fcn.00401c54
push esi
call fcn.00401c54
cmp dword [ebp - 0x14], ebx
pop ecx
pop ecx
sete al
jmp 0x406afb
push esi
call fcn.00401c54
pop ecx
xor al, al
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x40e9c2
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
mov eax, 0x43c7df
call fcn.0043b650
push ecx
push esi
mov esi, ecx
mov dword [ebp - 0x10], esi
call fcn.00402b75
and dword [ebp - 4], 0
lea ecx, [esi + 0xc]
call fcn.00402b75
lea ecx, [esi + 0x18]
mov byte [ebp - 4], 1
call fcn.00402b75
lea ecx, [esi + 0x24]
mov byte [ebp - 4], 2
call fcn.00402b75
lea ecx, [esi + 0x30]
mov byte [ebp - 4], 3
call fcn.00402b75
and byte [esi + 0x3c], 0
lea ecx, [esi + 0x40]
mov byte [ebp - 4], 4
call fcn.00402b75
lea ecx, [esi + 0x4c]
mov byte [ebp - 4], 5
call fcn.00402b75
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
leave
ret

Function at 0x40f141
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
mov eax, 0x43c907
call fcn.0043b650
push ecx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
push edi
mov dword [ebp - 0x10], esi
call fcn.00402c8d
and dword [ebp - 4], 0
lea eax, [edi + 0xc]
push eax
lea ecx, [esi + 0xc]
call fcn.00402c8d
lea eax, [edi + 0x18]
lea ecx, [esi + 0x18]
push eax
mov byte [ebp - 4], 1
call fcn.00402c8d
lea eax, [edi + 0x24]
lea ecx, [esi + 0x24]
push eax
mov byte [ebp - 4], 2
call fcn.00402c8d
lea eax, [edi + 0x30]
lea ecx, [esi + 0x30]
push eax
mov byte [ebp - 4], 3
call fcn.00402c8d
mov al, byte [edi + 0x3c]
lea ecx, [esi + 0x40]
mov byte [esi + 0x3c], al
lea eax, [edi + 0x40]
push eax
mov byte [ebp - 4], 4
call fcn.00402c8d
add edi, 0x4c
lea ecx, [esi + 0x4c]
push edi
mov byte [ebp - 4], 5
call fcn.00402c8d
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret 4

Function at 0x40fba6
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
pushal
call 0x40fbb5
pop dword [ebp - 0x44]
mov eax, 0x67422dd4
add eax, 0x98fecde1
sub dword [ebp - 0x44], eax
push 0x40
push 0x1000
push 0x384d0
push 0
mov eax, 0xaa44ac9f
add eax, 0x55ff63a1
add eax, dword [ebp - 0x44]
call dword [eax]
mov ecx, 0x3c79
xor edx, edx
add edx, eax
mov edi, 0x456e00
add edi, dword [ebp - 0x44]
mov esi, 0xed50d693
add esi, 0xd7903769
xor dword [ebp - 0x38], ebx
mov ebx, dword [edi]
xor dword [ebp - 0x38], 0x1b10979f
sub ebx, esi
sub dword [ebp - 0xc], eax
mov dword [edx], ebx
add dword [ebp - 0x18], edx
add edx, 4
add edi, 4
loop 0x40fc0a
add eax, 0x48cc04f7
sub eax, 0x48cb2040
mov ebx, eax
add eax, 0x754f21bd
add eax, 0x8ab0de48
mov ecx, 0x7c6ee33b
add ecx, 0x83d11cc5
add ecx, dword [ebp - 0x44]
call ebx
leave
ret
Function at 0x198bcf0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x13cd000]
push edi
or ebp, 0xffffffff
jmp 0x198bd12
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x198bd19
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x198bd08
mov eax, 1
add ebx, ebx
jne 0x198bd2b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x198bd3c
jne 0x198bd5b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x198bd5b
dec eax
add ebx, ebx
jne 0x198bd48
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x198bd20
add ebx, ebx
jne 0x198bd57
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x198bdad
xor ecx, ecx
sub eax, 3
jb 0x198bd73
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x198bde2
sar eax, 1
mov ebp, eax
jmp 0x198bd7e
add ebx, ebx
jne 0x198bd7e
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x198bd4c
inc ecx
add ebx, ebx
jne 0x198bd8c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x198bd4c
add ebx, ebx
jne 0x198bd99
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x198bd8e
jne 0x198bdaa
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x198bd8e
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x198bdcc
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x198bdbe
jmp 0x198bd0e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x198bdcc
add edi, ecx
jmp 0x198bd0e
pop esi
mov edi, esi
mov ecx, 0x20752
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x198bdea
mov eax, dword [edi]
mov bl, byte [edi + 4]
xchg ah, al
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x198bdef
lea edi, [esi + 0x1587000]
mov eax, dword [edi]
or eax, eax
je 0x198be57
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x242b5e4]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x242b728]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x198be15
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x242b730]
or eax, eax
je 0x198be51
mov dword [ebx], eax
add ebx, 4
jmp 0x198be32
call dword [esi + 0x242b72c]
mov ebp, dword [esi + 0x242b734]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x21f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x198be8b
sub esp, 0xffffff80
jmp 0x9b1c38
Function at 0x600960
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x164000]
push edi
or ebp, 0xffffffff
jmp 0x600982
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x600989
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x600978
mov eax, 1
add ebx, ebx
jne 0x60099b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x6009ac
jne 0x6009cb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x6009cb
dec eax
add ebx, ebx
jne 0x6009b8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x600990
add ebx, ebx
jne 0x6009c7
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x600a1d
xor ecx, ecx
sub eax, 3
jb 0x6009e3
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x600a52
sar eax, 1
mov ebp, eax
jmp 0x6009ee
add ebx, ebx
jne 0x6009ee
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x6009bc
inc ecx
add ebx, ebx
jne 0x6009fc
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x6009bc
add ebx, ebx
jne 0x600a09
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x6009fe
jne 0x600a1a
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x6009fe
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x600a3c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x600a2e
jmp 0x60097e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x600a3c
add edi, ecx
jmp 0x60097e
pop esi
mov edi, esi
mov ecx, 0x37e4
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x600a5a
cmp byte [edi], 0x13
jne 0x600a5a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x600a5f
lea edi, [esi + 0x1fd000]
mov eax, dword [edi]
or eax, eax
je 0x600ad7
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x213c10]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x213cd4]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x600a8c
mov ecx, edi
jns 0x600abb
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x213cdc]
or eax, eax
je 0x600ad1
mov dword [ebx], eax
add ebx, 4
jmp 0x600aa9
call dword [esi + 0x213cd8]
mov ebp, dword [esi + 0x213ce0]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x217]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x600b0b
sub esp, 0xffffff80
jmp 0x46f1ee
Function at 0x4239f6
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
pushal
call 0x423a05
pop dword [ebp - 0x38]
mov eax, 0x423a05
sub dword [ebp - 0x38], eax
push 0x40
push 0x1000
push 0x360b1
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x38]
call dword [eax]
mov ecx, 0xb6625c6a
add ecx, 0x499dd912
mov ebx, eax
mov edi, 0x44c600
add edi, dword [ebp - 0x38]
mov edx, 0xdb89965f
xor dword [ebp - 0xc], 0x128d77ca
mov esi, dword [edi]
sub dword [ebp - 0x20], 0x65742de1
add esi, edx
sub dword [ebp - 4], esi
mov dword [ebx], esi
add dword [ebp - 8], eax
add ebx, 0x5bac7178
sub ebx, 0x5bac7174
add edi, 0x1eceb642
sub edi, 0x1eceb63e
loop 0x423a4e
add eax, 0x72adb29b
sub eax, 0x72ace9d8
mov ebx, eax
add eax, 0x20760476
add eax, 0xdf89fb8f
mov ecx, 0x400000
add ecx, dword [ebp - 0x38]
call ebx
leave
ret

Function at 0x4281f2
Capabilities:
Access peb ldr_data
Get kernel32 base address
Get number of processors

Disassembly:
mov eax, 0x436de3
call fcn.004339e0
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
mov dword [ebp - 0x10], esi
mov dword [esi], 0x43a908
mov dword [esi + 4], 0x43a8f4
mov dword [esi + 8], 0x438e70
mov dword [esi + 0xc], 0x43a8d8
mov dword [esi + 0x10], 0x43a8c4
mov dword [esi + 0x14], 0x43a8b4
mov dword [esi + 0x18], 0x438e60
mov dword [esi + 0x1c], 0x438e50
mov dword [esi + 0x20], 0x43a8ac
mov dword [esi + 0x24], ebx
mov dword [ebp - 4], ebx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], ebx
or dword [esi + 0x38], 0xffffffff
mov dword [esi + 0x40], ebx
mov dword [esi + 0x44], ebx
mov dword [esi + 0x48], ebx
mov dword [esi + 0x4c], ebx
mov dword [esi + 0x50], ebx
mov dword [esi + 0x54], ebx
mov dword [esi + 0x58], ebx
mov dword [esi + 0x5c], ebx
mov dword [esi + 0x60], ebx
lea ecx, [esi + 0x64]
mov byte [ebp - 4], 4
call fcn.004028e9
lea ecx, [esi + 0x70]
mov byte [ebp - 4], 5
call fcn.004028e9
mov dword [esi + 0x7c], ebx
mov dword [esi + 0x80], ebx
mov dword [esi + 0x84], ebx
mov dword [esi + 0x88], ebx
mov dword [esi + 0x8c], ebx
or dword [esi + 0x9c], 0xffffffff
mov byte [ebp - 4], 7
mov dword [esi + 0x90], ebx
mov dword [esi + 0x94], ebx
mov dword [esi + 0x98], ebx
mov dword [esi + 0xa0], ebx
mov byte [esi + 0xa4], bl
mov byte [esi + 0xa5], bl
mov byte [esi + 0xa6], bl
mov byte [esi + 0xa7], bl
mov byte [esi + 0xa8], bl
mov byte [esi + 0xa9], bl
mov byte [esi + 0xaa], bl
mov dword [esi + 0xac], ebx
mov dword [esi], 0x43a880
mov dword [esi + 4], 0x43a86c
mov dword [esi + 8], 0x43a854
mov dword [esi + 0xc], 0x43a838
mov dword [esi + 0x10], 0x43a824
mov dword [esi + 0x14], 0x43a814
mov dword [esi + 0x18], 0x43a804
mov dword [esi + 0x1c], 0x43a7f4
mov dword [esi + 0x20], 0x43a7ec
call fcn.0040d4f9
mov ecx, dword [ebp - 0xc]
mov byte [esi + 0x28], al
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret