joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40330f
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, dword [ebp + 8]
push edi
xor edi, edi
test ecx, ecx
js 0x403338
mov eax, dword [0x435278]
push edi
add eax, ecx
push edi
push eax
push dword [0x40b014]
mov dword [0x40d974], eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 4
call fcn.00403190
test eax, eax
js 0x40340e
push ebx
push esi
push 4
lea eax, [ebp + 8]
push eax
push dword [0x40b014]
call fcn.0040691d
test eax, eax
je 0x403409
push dword [ebp + 8]
add dword [0x40d974], 4
call fcn.00403190
mov esi, eax
test esi, esi
js 0x403405
cmp dword [ebp + 0x10], edi
jne 0x4033d9
mov ecx, dword [ebp + 8]
test ecx, ecx
jle 0x403405
mov ebx, 0x4000
mov edi, 0x41f550
cmp ecx, ebx
mov eax, ebx
cmovl eax, ecx
push eax
push edi
push dword [0x40b014]
mov dword [ebp - 4], eax
call fcn.0040691d
test eax, eax
je 0x403409
push dword [ebp - 4]
push edi
push dword [ebp + 0xc]
call fcn.004069e0
test eax, eax
je 0x4033d5
mov eax, dword [ebp - 4]
add esi, eax
mov ecx, dword [ebp + 8]
add dword [0x40d974], eax
sub ecx, eax
mov dword [ebp + 8], ecx
test ecx, ecx
jg 0x403391
jmp 0x403405
push 0xfffffffffffffffe
jmp 0x40340b
push edi
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp + 0x14]
cmp dword [ebp + 8], eax
cmovl eax, dword [ebp + 8]
push eax
push dword [ebp + 0x10]
push dword [0x40b014]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x403409
mov esi, dword [ebp - 4]
add dword [0x40d974], esi
mov eax, esi
jmp 0x40340c
push 0xfffffffffffffffd
pop eax
pop esi
pop ebx
pop edi
leave
ret 0x10

Function at 0x403431
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x80
cmp dword [ebp + 8], 0
je 0x403459
mov eax, dword [0x40d988]
test eax, eax
je 0x403450
push eax
call dword [sym.imp.USER32.dll_DestroyWindow]
and dword [0x40d988], 0
leave
ret
cmp dword [0x40d988], 0
je 0x40346b
push 0
call fcn.004061e4
leave
ret
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, dword [0x435220]
jbe 0x4034d5
cmp dword [0x434218], 0
je 0x4034b0
test byte [0x435314], 1
je 0x4034d5
call fcn.00403413
push eax
lea eax, [ebp - 0x80]
push str....__d__
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea eax, [ebp - 0x80]
push eax
push 0
call fcn.00405d1e
leave
ret
push 0
push 0x4037b4
push 0
push 0x6f
push dword [0x434214]
call dword [sym.imp.USER32.dll_CreateDialogParamW]
push 5
push eax
mov dword [0x40d988], eax
call dword [sym.imp.USER32.dll_ShowWindow]
leave
ret
Function at 0x405e02
Capabilities:
Create directory

Disassembly:
push esi
xor esi, esi
push esi
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x405e1c
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov eax, esi
pop esi
ret 4
Function at 0x406173
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x23c
lea eax, [ebp - 0x23c]
push esi
mov esi, 0x104
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
cmp eax, esi
pop esi
ja 0x4061ad
test eax, eax
je 0x4061ad
add eax, eax
cmp word [ebp + eax - 0x23e], 0x5c
je 0x4061af
mov ecx, 0x4092a8
jmp 0x4061b4
xor eax, eax
mov ecx, 0x4092aa
push dword [ebp + 8]
push ecx
lea ecx, [ebp - 0x23c]
add eax, ecx
push str._s_S.dll
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea eax, [ebp - 0x23c]
push 8
push 0
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
leave
ret 4

Function at 0x406212
Capabilities:
Move file

Disassembly:
push 5
push dword [esp + 0xc]
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
jne 0x406235
push dword [esp + 8]
push dword [esp + 8]
call fcn.004062db
pop ecx
pop ecx
inc dword [0x4352f0]
ret 8

Function at 0x4062db
Capabilities:
Get file size

Disassembly:
push ebx
push ebp
push esi
mov esi, dword [esp + 0x14]
mov ebx, 0x400
mov dword [0x4311d8], 0x55004e
mov ebp, 0x4311d8
mov dword [0x4311dc], 0x4c
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetShortPathNameW]
test esi, esi
je 0x406331
push 1
push 0
push esi
call fcn.004068f0
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
push ebp
push esi
call edi
test eax, eax
je 0x406411
cmp eax, ebx
jg 0x406411
push ebx
mov esi, 0x4309d8
push esi
push dword [esp + 0x1c]
call edi
test eax, eax
je 0x406411
cmp eax, ebx
jg 0x406411
push esi
push ebp
push str._ls_ls_r_n
push 0x4305d8
call dword [sym.imp.USER32.dll_wsprintfA]
mov ecx, dword [0x435230]
add esp, 0x10
mov ebp, eax
push dword [ecx + 0x128]
push esi
call fcn.00405e7d
push 4
push 0xc0000000
push esi
call fcn.004068f0
mov ebx, eax
cmp ebx, 0xffffffff
je 0x406411
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
lea ecx, [ebp + 0xa]
add ecx, esi
push ecx
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov edi, eax
test edi, edi
je 0x40640a
push esi
push edi
push ebx
call fcn.0040691d
test eax, eax
je 0x40640a
push str._Rename__r_n
push edi
call fcn.00406b0b
test eax, eax
jne 0x406416
push str._Rename__r_n
lea eax, [edi + esi]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
add esi, 0xa
mov ecx, esi
push ebp
push 0x4305d8
lea eax, [ecx + edi]
push eax
call fcn.00406689
xor eax, eax
push eax
push eax
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
lea eax, [esi + ebp]
push eax
push edi
push ebx
call fcn.004069e0
push edi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
pop ebx
ret
push 0x409984
add eax, 0xa
push eax
call fcn.00406b0b
mov ecx, eax
test ecx, ecx
je 0x4063db
lea edx, [edi + esi]
jmp 0x406435
mov al, byte [edx]
mov byte [edx + ebp], al
dec edx
cmp edx, ecx
ja 0x40642f
sub ecx, edi
inc ecx
jmp 0x4063dd
Function at 0x40655a
Capabilities:
Delete directory
Delete file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push edi
push dword [ebp + 8]
call fcn.00406b72
mov edi, eax
cmp edi, 0xffffffff
je 0x40659d
test byte [ebp + 0xc], 1
push dword [ebp + 8]
je 0x40657e
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
jmp 0x406584
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x40658d
xor eax, eax
inc eax
jmp 0x40659f
test byte [ebp + 0xc], 4
jne 0x40659d
push edi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
xor eax, eax
pop edi
pop ebp
ret 8

Function at 0x40660d
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
push esi
push dword [esp + 0xc]
mov ebx, 0x42fdd8
push ebx
call fcn.00406aef
push ebx
call fcn.00406b9a
mov esi, eax
test esi, esi
je 0x406682
push esi
call fcn.00406d12
test byte [0x43522c], 0x80
je 0x406646
movzx eax, word [esi]
test ax, ax
je 0x406682
cmp eax, 0x5c
je 0x406682
sub esi, ebx
sar esi, 1
jmp 0x406660
call fcn.004065a4
test eax, eax
je 0x40665a
test byte [eax], 0x10
je 0x406682
push ebx
call fcn.00406ce5
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push ebx
cmp eax, esi
jg 0x40664c
call fcn.0040652b
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x406682
xor eax, eax
inc eax
jmp 0x406684
xor eax, eax
pop esi
pop ebx
ret 4

Function at 0x4066ab
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [0x42f590], 0x44
lea eax, [ebp - 0x10]
push eax
push 0x42f590
xor eax, eax
push eax
push eax
push 0x4000000
push eax
push eax
push eax
push dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x4066ea
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x10]
leave
ret 4
Function at 0x4066ee
Capabilities:
Delete file
Enumerate files on windows
Enumerate files recursively

Disassembly:
sub esp, 0x25c
push ebx
mov ebx, dword [esp + 0x268]
push esi
mov esi, dword [esp + 0x268]
push edi
mov edi, ebx
push esi
and edi, 4
call fcn.0040660d
mov dword [esp + 0x14], eax
test bl, 8
je 0x406730
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
neg eax
sbb eax, eax
inc eax
add dword [0x4352e8], eax
jmp 0x4068af
push ebp
mov ebp, ebx
and ebp, 1
mov dword [esp + 0x14], ebp
je 0x40674d
test eax, eax
je 0x40689e
test bl, 2
je 0x406867
push esi
push 0x42f5d8
call fcn.00406aef
test ebp, ebp
mov ebp, dword [sym.imp.KERNEL32.dll_lstrcatW]
je 0x406770
push str..
push 0x42f5d8
call ebp
jmp 0x406776
push esi
call fcn.00406ce5
xor eax, eax
cmp word [esi], ax
jne 0x406787
cmp word [0x42f5d8], 0x5c
jne 0x40678f
push 0x4092a8
push esi
call ebp
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [esi + eax*2]
mov dword [esp + 0x10], eax
lea eax, [esp + 0x1c]
push eax
push 0x42f5d8
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov ebp, eax
cmp ebp, 0xffffffff
je 0x406850
push 0x2e
pop eax
cmp word [esp + 0x48], ax
jne 0x4067d9
cmp word [esp + 0x4a], 0
je 0x406832
cmp word [esp + 0x4a], ax
jne 0x4067d9
cmp word [esp + 0x4c], 0
je 0x406832
lea eax, [esp + 0x48]
push eax
push dword [esp + 0x14]
call fcn.00406aef
test byte [esp + 0x1c], 0x10
je 0x406800
mov eax, ebx
and eax, 3
cmp al, 3
jne 0x406832
push ebx
push esi
call fcn.004066ee
jmp 0x406832
push edi
push esi
call fcn.0040655a
test eax, eax
jne 0x40682a
test edi, edi
je 0x406822
push esi
push 0xfffffffffffffff1
call fcn.00405d1e
xor eax, eax
push eax
push esi
call fcn.00406212
jmp 0x406832
inc dword [0x4352e8]
jmp 0x406832
push esi
push 0xfffffffffffffff2
call fcn.00405d1e
lea eax, [esp + 0x1c]
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
push 0x2e
test eax, eax
pop eax
jne 0x4067bb
push ebp
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp dword [esp + 0x14], 0
je 0x4068ae
mov eax, dword [esp + 0x10]
xor ecx, ecx
mov word [eax - 2], cx
cmp dword [esp + 0x18], ecx
je 0x40689e
push esi
call fcn.004065a4
test eax, eax
je 0x4068ae
push esi
call fcn.0040652b
mov eax, edi
or eax, 1
push eax
push esi
call fcn.0040655a
test eax, eax
jne 0x4068a6
test edi, edi
je 0x40689e
push esi
push 0xfffffffffffffff1
call fcn.00405d1e
xor eax, eax
push eax
push esi
call fcn.00406212
jmp 0x4068ae
inc dword [0x4352e8]
jmp 0x4068ae
push esi
push 0xffffffffffffffe5
call fcn.00405d1e
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x25c
ret 8

Function at 0x4068f0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor ecx, ecx
cmp eax, 0xffffffff
push 0
cmove eax, ecx
push eax
push dword [esp + 0x14]
push ecx
push 1
push dword [esp + 0x1c]
push dword [esp + 0x1c]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
ret 0xc
Function at 0x40694c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push edi
lea eax, [ebp - 4]
mov dword [ebp - 8], 0x800
push eax
mov eax, dword [ebp + 0x18]
neg eax
sbb eax, eax
and eax, 0x100
or eax, 0x20019
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.004062ad
mov edi, dword [ebp + 0x14]
test eax, eax
jne 0x4069be
push esi
lea eax, [ebp - 8]
push eax
push edi
lea eax, [ebp + 0x18]
push eax
push 0
push dword [ebp + 0x10]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
test esi, esi
mov word [edi + 0x7fe], ax
pop esi
jne 0x4069be
cmp dword [ebp + 0x18], 1
je 0x4069c3
cmp dword [ebp + 0x18], 2
je 0x4069c3
xor eax, eax
mov word [edi], ax
pop edi
leave
ret 0x14

Function at 0x4069c8
Capabilities:
Create process on windows

Disassembly:
mov eax, dword [esp + 4]
push eax
and dword [eax + 0x24], 0
mov dword [eax], 0x3c
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
ret 4

Function at 0x406a2b
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
mov esi, dword [ebp + 8]
push edi
push 0x64
pop edi
dec edi
mov dword [ebp - 8], 0x73006e
mov dword [ebp - 4], 0x61
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push 0x1a
pop ecx
xor edx, edx
div ecx
push esi
add word [ebp - 4], dx
lea eax, [ebp - 8]
push 0
push eax
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
jne 0x406a75
test edi, edi
jne 0x406a38
mov word [esi], ax
jmp 0x406a77
mov eax, esi
pop edi
pop esi
leave
ret 8

Function at 0x406b72
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push esi
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov esi, eax
cmp esi, 0xffffffff
je 0x406b94
mov ecx, esi
and ecx, 0xfffffffe
push ecx
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov eax, esi
pop esi
ret 4

Function at 0x406e11
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x431c2c], 0
push esi
jne 0x406e4b
xor ecx, ecx
push 8
mov edx, ecx
pop esi
mov eax, edx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr edx, 1
and eax, 0xedb88320
xor edx, eax
sub esi, 1
jne 0x406e22
mov dword [ecx*4 + 0x431c28], edx
inc ecx
cmp ecx, 0x100
jl 0x406e1d
mov ecx, dword [esp + 8]
mov edx, dword [esp + 0x10]
not ecx
test edx, edx
je 0x406e75
mov esi, dword [esp + 0xc]
movzx eax, byte [esi]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x431c28]
inc esi
sub edx, 1
jne 0x406e5d
not ecx
mov eax, ecx
pop esi
ret 0xc
Function at 0x404786
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x4047c5
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4047c5
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4047c5
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x4047c5
cmp dword [ecx + 0x74], 0xe
jbe 0x4047c5
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x40a2b0
Capabilities:
Get disk information

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
cmp eax, 0x1a
jbe 0x40a2f3
call fcn.0040b88c
mov dword [eax], 0xf
call fcn.0040b89f
mov dword [eax], 0xd
call fcn.00409870
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00403ed8
leave
ret
test eax, eax
jne 0x40a2fa
inc eax
jmp 0x40a2e7
add eax, 0x40
push 0x3a
mov word [ebp - 0xc], ax
pop eax
mov word [ebp - 0xa], ax
push 0x5c
pop eax
mov word [ebp - 8], ax
xor eax, eax
mov word [ebp - 6], ax
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
mov ecx, eax
test ecx, ecx
je 0x40a2e5
xor eax, eax
cmp ecx, 1
setne al
jmp 0x40a2e7

Function at 0x40d73a
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x419be8
push 0x419be0
push str.FlsAlloc
push 0x1f
call fcn.0040d5f9
mov esi, eax
add esp, 0x10
test esi, esi
je 0x40d76e
push dword [ebp + 8]
mov ecx, esi
call dword [0x418188]
call esi
jmp 0x40d774
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x40d7b8
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x419bf8
push 0x419bf0
push str.FlsGetValue
push 0x21
call fcn.0040d5f9
mov esi, eax
add esp, 0x10
test esi, esi
je 0x40d7ef
push dword [ebp + 8]
mov ecx, esi
call dword [0x418188]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x40d7f7
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x419c00
push 0x419bf8
push str.FlsSetValue
push 0x22
call fcn.0040d5f9
mov esi, eax
add esp, 0x10
test esi, esi
je 0x40d831
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x418188]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x40efc4
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x40f061
push ebx
push esi
call fcn.0040ef8d
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.0040de49
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x40f00e
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x40f060
push edi
push eax
call fcn.0040b8ec
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x40f02e
call fcn.0040b8b2
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x40f05f
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.0040de49
add esp, 0x20
test eax, eax
jne 0x40f04d
push edi
call fcn.0040b8b2
jmp 0x40f055
push ebx
call fcn.0040b8b2
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret
Function at 0x416ff0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x41701d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x41701d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x908210
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x3a0000]
push edi
jmp 0x90822a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x908231
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x908220
mov eax, 1
add ebx, ebx
jne 0x908243
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x908254
jne 0x908273
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x908273
dec eax
add ebx, ebx
jne 0x908260
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x908238
add ebx, ebx
jne 0x90826f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x9082c5
xor ecx, ecx
sub eax, 3
jb 0x90828b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x9082fa
sar eax, 1
mov ebp, eax
jmp 0x908296
add ebx, ebx
jne 0x908296
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x908264
inc ecx
add ebx, ebx
jne 0x9082a4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x908264
add ebx, ebx
jne 0x9082b1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x9082a6
jne 0x9082c2
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x9082a6
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x9082e4
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x9082d6
jmp 0x908226
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x9082e4
add edi, ecx
jmp 0x908226
pop esi
mov edi, esi
mov ecx, 0x9163
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x908302
cmp byte [edi], 0x32
jne 0x908302
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x908307
lea edi, [esi + 0x504000]
mov eax, dword [edi]
or eax, eax
je 0x90837f
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x51a0bc]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x51a1fc]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x908334
mov ecx, edi
jns 0x908363
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x51a200]
or eax, eax
je 0x908379
mov dword [ebx], eax
add ebx, 4
jmp 0x908351
call dword [esi + 0x51a210]
mov ebp, dword [esi + 0x51a204]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x31f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x9083b3
sub esp, 0xffffff80
jmp section.UPX0
Function at 0x10001016
Capabilities:
Extract resource via kernel32 functions
Write file on windows

Disassembly:
push ecx
push esi
push edi
push 0x10003010
push 0x65
push dword [0x1000313c]
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
test edi, edi
je 0x10001061
push edi
push dword [0x1000313c]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x10001061
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x10001061
push edi
push dword [0x1000313c]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
test eax, eax
jne 0x10001065
xor eax, eax
jmp 0x100010a7
push ebx
mov ebx, dword [esi]
push 0
push 4
push 2
push 0
push 2
push 0x40000000
push 0x10003038
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x100010a3
lea eax, [esp + 0xc]
push 0
push eax
add esi, 4
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 1
pop eax
pop ebx
pop edi
pop esi
pop ecx
ret

Function at 0x100010ab
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
push edi
xor edx, edx
xor eax, eax
lea edi, [ebp - 0xc]
mov dword [ebp - 0x10], edx
push 0x10
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
pop ecx
xor eax, eax
lea edi, [ebp - 0x50]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x10]
mov dword [ebp - 0x54], 0x44
push eax
lea eax, [ebp - 0x54]
push eax
push edx
push edx
push 0x8000000
push edx
push edx
push edx
push 0x10003038
push edx
mov word [ebp - 0x24], dx
mov dword [ebp - 0x28], 0x81
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
pop edi
je 0x10001110
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0xc]
call esi
push dword [ebp - 0x10]
call esi
pop esi
xor eax, eax
leave
ret

Function at 0x430002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
mov eax, section..idata
nop
mov ebx, 0x408ecc
nop
mov ecx, 0x715570ca
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x43004e
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x430024
nop
nop
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x42e1d0
mov ecx, 0xe630e15
nop
nop
test eax, eax
nop
nop
nop
je 0x430084
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x43006c
nop
nop
nop
nop
nop
popal
nop
jmp 0x401219

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx