joyce8/EMBER2024-capa huggingface dataset:
Function at 0x430002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x408ecc
nop
mov ecx, 0x17e0188f
nop
nop
test eax, eax
nop
nop
nop
je 0x43004e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x430024
nop
nop
mov eax, section..data
nop
nop
mov ebx, 0x42e1d0
nop
mov ecx, 0x42d65d4e
nop
test eax, eax
nop
nop
nop
nop
je 0x430084
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
add eax, 4
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x43006c
nop
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x401219
Function at 0x16a4120
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.GVD1
lea edi, [esi - 0x1270000]
push edi
or ebp, 0xffffffff
jmp 0x16a4142
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x16a4149
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
mov al, byte [edi]
jb 0x16a4138
mov eax, 1
add ebx, ebx
jne 0x16a415d
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x16a416e
jne 0x16a417e
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x16a417e
dec eax
add ebx, ebx
jne 0x16a417a
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x16a4152
xor ecx, ecx
sub eax, 3
jb 0x16a4196
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x16a420a
sar eax, 1
mov ebp, eax
jmp 0x16a41a1
add ebx, ebx
jne 0x16a41a1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x16a41ae
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x16a41d2
inc ecx
add ebx, ebx
jne 0x16a41be
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x16a41b3
jne 0x16a41cf
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x16a41b3
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
mov al, byte [edi + ecx]
jbe 0x16a41f4
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x16a41e6
jmp 0x16a413e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x16a41f4
add edi, ecx
jmp 0x16a413e
pop esi
mov edi, esi
mov ecx, 0x346a
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x16a4212
cmp byte [edi], 0x16
jne 0x16a4212
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov eax, ebx
loop 0x16a4217
lea edi, [esi + 0x12a1000]
mov eax, dword [edi]
or eax, eax
je 0x16a4286
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x12a57f8]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x12a58e8]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x16a4244
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x12a58ec]
or eax, eax
je 0x16a4280
mov dword [ebx], eax
add ebx, 4
jmp 0x16a4261
call dword [esi + 0x12a58f0]
popal
jmp 0x46b748

Function at 0x433005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
call 0x43300c
nop
nop
nop
nop
nop
pop eax
nop
add eax, 0x40a063
sub eax, 0x40a009
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
xor dword [ebx], edx
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
jl 0x433030
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x43301e
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x431219
Function at 0x1449f00
Capabilities:
Encode data using xor

Disassembly:
jmp 0x1449f0a
pushal
call 0x1449f10
pop ebp
sub ebp, 0x10
sub ebp, 0x1049f00
jmp 0x1449f26
add ch, al
push ds
push ebp
dec eax
mov eax, 0x1049f00
add eax, ebp
add eax, 0x4c
mov ecx, 0x5be
mov edx, 0x8145755b
xor byte [eax], dl
inc eax
dec ecx
jne 0x1449f3d
invalid
jmp 0x1449f50
rcl byte [esi + 0x5b67d2d0]
pop ebx
pop ebx
ficomp dword [edx + 0x5b5b5ba3]
pop eax
xchg esi, eax
jecxz 0x1449fc0
pop ebx
pop ebx
pop ebx
loope 0x1449fda
pop ebx
pop ebx
pop ebx
lodsb al, byte [esi]
mov ecx, 0xdad09358
push edi
pop ebx
pop ebx
pop ebx
pop eax
sahf
salc
aas
jg 0x1449f21
rcr byte [edi + 0x7f], cl
or esi, dword [ebx]
xor dword [esi + 0x44], 0x5b
xor esi, dword [ebx + 0x2a]
mov esi, 0x7f775a5b
ja 0x144a00a
xor edx, eax
test dword [eax], eax
sal byte [ebx + 0x5b5b5b5e], 0xb2
imul ebx, dword [ebx + 0x5b], 0x5b
salc
aas
jg 0x1449f45
sal byte [edi + 0x7f], cl
salc
aaa
jg 0x144a000
rcr dh, 1
push ebx
pop ebx
pop ebx
pop ebx
ror dh, 1
push edi
pop ebx
pop ebx
pop ebx
rcl dh, 1
dec ebx
pop ebx
pop ebx
pop ebx
lcall 0x99d8, 0x596a59b2
pop edi
adc dl, byte [esi + ebx*8 - 0x51]
movsb byte es:[edi], byte [esi]
movsb byte es:[edi], byte [esi]
movsb byte es:[edi], byte [esi]
push es
push esp
fisubr word [edi + 0x6a4a4a4]
cdq
push edi
pop ebx
rcl bh, 1
jg 0x144a02d
pop ebx
pop ebx
pop ebx
xor eax, dword [ebx + 0x335b4476]
jae 0x144a003
mov esi, 0x7f775a5b
pop ebx
pop edx
ja 0x144a05d
salc
aas
jg 0x1449f89
rcl byte [edi + 0x7f], cl
mov bl, 0x5e
pop ebx
pop ebx
pop ebx
mov dl, 0x64
pop ecx
pop ebx
pop ebx
push cs
clts
movsb byte es:[edi], byte [esi]
push edi
movsb byte es:[edi], byte [esi]
push ebx
mov bl, 0x29
pop ebx
pop ebx
pop ebx
shl dh, 1
push ebx
pop ebx
pop ebx
pop ebx
push 0xc9a9da92
dec ebp
cld
cdq
fisubr dword [ecx - 0x6603b237]
push 0x5eb3d889
adc edx, dword [edi + ebx*8 + 0x15]
pop ebx
pop ebx
pop ebx
push esp
rcl dword [ebx], cl
pop ebx
pop ebx
pop ebx
cmp eax, 0xdb6247d0
mov al, byte [0x41df54b3]
pop ebx
pop ebx
pop ebx
invalid
fcomp dword [edx + 0x5fb1d85d]
fdiv dword [ebx - 0x5b0f4da2]
movsb byte es:[edi], byte [esi]
movsb byte es:[edi], byte [esi]
push es
cdq
push edi
pop ebx
push cs
sal byte [edi - 0x2ff1f3f3], 1
push edi
shl byte [esi], 1
push ebx
cmpsd dword [esi], dword es:[edi]
jmp 0xdba2725c
Function at 0x43b652
Capabilities:
Encode data using xor

Disassembly:
mov edi, 0x43b3c1
mov ebx, 0x2b556633
add ebx, 0xd092ccc0
call fcn.0043b68a
or ebx, eax
push 0x61b322e1
pop ebx
xor dword [esi], edi
or eax, eax
dec ebx
inc esi
dec eax
cmp esi, edx
jne fcn.0043b652
and ebx, ebx
ret

Function at 0x418180
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x12000]
push edi
or ebp, 0xffffffff
jmp 0x4181a2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x4181a9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x418198
mov eax, 1
add ebx, ebx
jne 0x4181bb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x4181b0
jne 0x4181cc
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4181b0
xor ecx, ecx
sub eax, 3
jb 0x4181e0
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x418252
mov ebp, eax
add ebx, ebx
jne 0x4181eb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x4181f8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x41821c
inc ecx
add ebx, ebx
jne 0x418208
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x4181fd
jne 0x418219
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4181fd
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x41823c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x41822d
jmp 0x41819e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x41823c
add edi, ecx
jmp 0x41819e
pop esi
mov edi, esi
mov ecx, 0x3b2
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x41825a
cmp byte [edi], 0
jne 0x41825a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov eax, ebx
loop 0x41825f
lea edi, [esi + 0x16000]
mov eax, dword [edi]
or eax, eax
je 0x4182ce
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x180b0]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x18114]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x41828c
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x18118]
or eax, eax
je 0x4182c8
mov dword [ebx], eax
add ebx, 4
jmp 0x4182a9
call dword [esi + 0x1811c]
popal
jmp 0x40a630

Function at 0x403e1f
Capabilities:
Encode data using xor

Disassembly:
call dword [ebp - 0x75]
in al, dx
push esi
or dword [ebx + 0x7501047e], eax
add dword [ebp + 3], esi
push eax
call ebx
invalid
invalid
add dword [ebp + 3], esi
push eax
call ebx
rol esi, 8
cmp esi, 0xc71568
jl 0x403e16
out 0x5e, al
pop esi
pop ebx
and al, 0
add byte [ebx + 0x48810c45], cl
or al, 0xff
xor al, 0xc5
dec eax
adc al, 0
add byte [ebp - 4], al
push eax
push dword [ebp + 0xc]
push dword [ebp + 0x6a]
or al, 0x68
loopne 0x403e2f
inc eax
add byte [edx + 0x5a], ch
stc
invalid
Function at 0x474940
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x51000]
push edi
jmp 0x47495a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x474961
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x474950
mov eax, 1
add ebx, ebx
jne 0x474973
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x474968
jne 0x474984
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x474968
xor ecx, ecx
sub eax, 3
jb 0x474998
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x474a0a
mov ebp, eax
add ebx, ebx
jne 0x4749a3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x4749b0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x4749d4
inc ecx
add ebx, ebx
jne 0x4749c0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x4749b5
jne 0x4749d1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4749b5
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x4749f4
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x4749e5
jmp 0x474956
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x4749f4
add edi, ecx
jmp 0x474956
pop esi
lea edi, [esi + 0x38000]
mov ecx, 8
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x474a16
cmp byte [edi], 0xa
jne 0x474a16
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x474a1b
lea edi, [esi + 0x72000]
mov eax, dword [edi]
or eax, eax
je 0x474a93
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x76140]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x7617c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x474a48
mov ecx, edi
jns 0x474a77
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x76180]
or eax, eax
je 0x474a8d
mov dword [ebx], eax
add ebx, 4
jmp 0x474a65
call dword [esi + 0x76190]
mov ebp, dword [esi + 0x76184]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x15f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x474ac7
sub esp, 0xffffff80
jmp 0x402940

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
nop
nop
nop
pop eax
nop
nop
nop
add eax, 0x403d6f
nop
sub eax, 0x403d15
mov ebx, dword [eax]
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
jl 0x430030
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
nop
jne 0x43001e
nop
popal
nop
nop
nop
nop
nop
jmp loc.00401219
Function at 0x40f3e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
movzx eax, word [0x444548]
push esi
push edi
mov edi, dword [ebp + 8]
and eax, 0x9128c04c
mov word [0x444548], ax
mov ecx, edi
and dword [0x43939c], 0x24d6dc85
call fcn.00413180
mov ecx, dword [0x438704]
mov esi, eax
sub ecx, dword [0x4359f8]
cmp ecx, 0x1940d340
je 0x40f42b
and dword [0x43a09c], 0x5987607e
mov ecx, edi
call fcn.0041b520
cmp esi, eax
je 0x40f4d5
lea ebx, [ebx]
imul ecx, dword [0x43c6c8], 0x11ed232b
mov eax, dword [0x440544]
inc dword [0x43c6c8]
and eax, 0x8e09000
or eax, 0x661106b1
xor ecx, 0xdf4b8f
cmp ecx, eax
jl 0x40f486
mov ax, word [0x44a4ba]
movzx ecx, word [0x444bf4]
cwde
sub ecx, eax
add ecx, 0x75007845
mov word [0x444bf4], cx
mov byte [esi], 0
cmp dword [0x441b3c], 0xa57f2098
jle 0x40f4a7
movzx eax, word [0x443e5e]
add eax, 0x494d192e
mov word [0x443e5e], ax
dec dword [0x43e438]
inc esi
mov ecx, dword [0x43e438]
mov eax, dword [0x43ce04]
add ecx, 0xf3749ef4
add eax, ecx
mov ecx, edi
mov dword [0x43ce04], eax
call fcn.0041b520
cmp esi, eax
jne 0x40f440
mov edx, dword [0x43fd10]
mov ecx, edi
movzx eax, word [0x445cce]
not edx
xor edx, 0xd8723c1
or eax, edx
mov word [0x445cce], ax
call fcn.004287f0
and dword [0x43e57c], 0x5b2a11d7
pop edi
pop esi
pop ebp
ret
Function at 0x412d10
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x43d678]
sub esp, 8
xor eax, dword [0x43a818]
mov dword [0x43d678], eax
movzx eax, word [0x446d58]
push esi
push edi
sub eax, 0x20080480
mov word [0x446d58], ax
push 0
call fcn.0040a980
mov ecx, dword [0x43cbb4]
add esp, 4
xor ecx, dword [0x435e54]
mov esi, eax
mov dword [0x43cbb4], ecx
mov edi, edx
inc dword [0x435e54]
cmp dword [0x44a734], 0
jne 0x412e19
cmp dword [0x44af4c], 0
jne 0x412e19
mov eax, dword [0x43a488]
not eax
imul eax, eax, 0xfd235ce0
push 0
and dword [0x439388], eax
call fcn.0040a980
add esp, 4
sub eax, esi
sbb edx, edi
test edx, edx
jg 0x412df9
jl 0x412db0
test eax, eax
jae 0x412df9
jmp 0x412db0
movsx eax, word [0x446dd4]
mov ecx, 0xc8284985
sub ecx, eax
add dword [0x43f5a0], ecx
inc word [0x446dd4]
push 0x3e8
call dword [0x44b154]
xor dword [0x43bde4], 0x7a948aa
push 0
call fcn.0040a980
add esp, 4
sub eax, esi
sbb edx, edi
mov dword [ebp - 4], edx
js 0x412db0
jg 0x412df9
test eax, eax
jb 0x412db0
mov ax, word [0x447b40]
movsx ecx, ax
mov eax, dword [0x43e260]
add eax, ecx
movzx ecx, word [0x443e02]
or ecx, eax
mov word [0x443e02], cx
add dword [0x43a780], 0x7fa77dff
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x41ccb0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
movzx eax, word [0x44587a]
xor eax, 0xf6b9caed
mov word [0x44587a], ax
add dword [0x43eca8], 0x4428211
movzx eax, word [0x44a528]
push ebx
mov ebx, dword [ebp + 0x18]
imul eax, eax, 0x66a419d
push esi
push edi
mov word [0x44a528], ax
mov eax, dword [ebx + 4]
shl eax, 2
push eax
push 0
push dword [ebx + 8]
call fcn.0040c0f0
movzx eax, word [0x4440b0]
add esp, 0xc
mov edi, dword [ebp + 0x10]
and eax, 0x3a36761c
mov word [0x4440b0], ax
mov edx, dword [ebx + 8]
inc dword [0x436c7c]
mov eax, dword [0x436c7c]
add dword [0x43f1d0], eax
movzx eax, word [0x444664]
mov ebx, dword [edi + 4]
xor eax, 0x2a194db
mov word [0x444664], ax
mov ecx, ebx
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], edx
mov eax, dword [eax + 4]
cmp eax, ebx
cmovl ecx, eax
mov dword [ebp - 0xc], ecx
mov ecx, dword [0x440ffc]
mov eax, dword [0x43c8a8]
sar ecx, 9
add eax, ecx
xor ecx, ecx
mov dword [0x43bd88], eax
dec dword [0x43c8a8]
mov dword [ebp - 8], ecx
test ebx, ebx
jle 0x41ce43
jmp 0x41cd80
imul eax, dword [0x43fbfc], 0xe600a124
mov dword [0x43fbfc], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax + 8]
mov edi, dword [eax + ecx*4]
add dword [0x4431e4], 0x4cb09a6c
mov ecx, dword [ebp + 0xc]
push edi
push edx
mov eax, dword [ecx + 8]
mov esi, dword [eax]
movsx eax, word [0x44863e]
imul esi, edi
and eax, 0x14204204
add esi, dword [edx]
xor dword [0x43f260], eax
inc word [0x44863e]
push dword [ecx + 8]
imul esi, dword [ebp + 0x14]
push dword [ebp - 0xc]
call fcn.00411e40
movzx eax, word [0x4492aa]
imul eax, eax, 0xa205
push esi
push dword [ebp - 4]
mov word [0x4492aa], ax
mov eax, dword [ebp + 0x10]
push dword [eax + 8]
push ebx
call fcn.00411e40
mov edx, dword [ebp - 4]
mov eax, 0x4b21
mov ecx, dword [ebp - 8]
add esp, 0x20
mov word [0x444ce8], ax
inc ecx
mov dword [ebp - 8], ecx
mov dword [edx], edi
add edx, 4
or dword [0x438028], 0xd7f7bf7
mov dword [ebp - 4], edx
mov dword [edx + ebx*4 + 4], 0
or dword [0x43ba44], 0x1e5725ed
cmp ecx, ebx
jl 0x41cd80
mov edi, dword [ebp + 0x10]
mov esi, dword [ebp + 8]
lea eax, [ebx*4 + 4]
add dword [0x4366ac], 0xa42c2413
push eax
push edx
push dword [esi + 8]
call fcn.0040dea0
mov eax, dword [0x436ec8]
add esp, 0xc
imul eax, dword [0x439b10]
dec dword [0x436ec8]
cmp eax, 0xef5d2b55
jge 0x41ce93
mov eax, dword [0x4403e0]
and eax, dword [0x43c930]
mov dword [0x4403e0], eax
dec dword [0x43c930]
push edi
push esi
call fcn.00425230
add esp, 8
test eax, eax
js 0x41cea9
push dword [esi + 8]
push dword [edi + 8]
jmp 0x41ceb2
mov eax, dword [ebp + 0x18]
push dword [eax + 8]
push dword [esi + 8]
push ebx
call fcn.00426880
add esp, 0xc
add dword [0x43e960], 0x2c00a322
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x41dc90
Capabilities:
Hash data with md5

Disassembly:
add dword [0x43fe28], 0x8084000
mov edx, ecx
mov dword [edx], 0
imul eax, dword [0x4374a8], 0xd580c710
mov dword [0x43d1b0], eax
mov dword [edx + 4], 0
imul eax, dword [0x438a7c], 0xc537efa
mov dword [0x438a7c], eax
mov dword [edx + 8], 0x67452301
add dword [0x43ad2c], 0x4505713c
mov dword [edx + 0xc], 0xefcdab89
inc word [0x445d24]
mov ax, word [0x445d24]
cwde
and eax, dword [0x435a9c]
mov dword [0x435a9c], eax
mov dword [edx + 0x10], 0x98badcfe
mov ecx, dword [0x43f9c0]
mov eax, dword [0x43820c]
not ecx
and eax, ecx
cmp eax, 0x3b4c1d0f
jne 0x41dd1f
mov dword [0x43f0c8], 0x7c36bfff
mov dword [edx + 0x14], 0x10325476
or dword [0x43a2b4], 0x95b569ca
ret
Function at 0x427b70
Capabilities:
Encode data using xor

Disassembly:
dec dword [0x43c2b0]
mov eax, dword [0x43c2b0]
add eax, 0xe09d1f0
xor eax, dword [0x437614]
push esi
push edi
mov dword [0x437614], eax
mov edi, ecx
or dword [0x43cd6c], 0xb086062c
call fcn.00413180
cmp dword [0x436560], 0x6fbf96bd
mov esi, eax
jne 0x427bd9
imul ecx, dword [0x438980], 0xe468e74d
inc dword [0x438980]
cmp ecx, 0xfd4b4f65
jg 0x427c09
movsx ecx, word [0x44a486]
xor ecx, 0xe762c75b
add dword [0x439988], ecx
jmp 0x427c09
mov eax, dword [0x437518]
or eax, 0xd000a804
cmp eax, 0xdee19f09
jle 0x427c09
dec dword [0x43e2e8]
mov eax, dword [0x43e2e8]
mov ecx, dword [0x43ea60]
and ecx, eax
and ecx, 0xc24304
mov dword [0x43ea60], ecx
mov ecx, edi
call fcn.0041b520
cmp esi, eax
je 0x427c4d
movzx eax, word [0x447c3c]
mov ecx, edi
cwde
and dword [0x43bb2c], eax
mov byte [esi], 0
inc esi
xor dword [0x43c8c8], 0xaebacb3e
movzx eax, word [0x4439c8]
add eax, 0x678c6cd9
mov word [0x4439c8], ax
call fcn.0041b520
cmp esi, eax
jne 0x427c14
and dword [0x439134], 0xd3a5597e
pop edi
pop esi
ret

Function at 0x401219
Capabilities:
Terminate process

Disassembly:
mov eax, dword fs:[0]
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x40601c
push 0x40109a
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
push eax
fnstcw word [esp]
or word [esp], 0x300
fldcw word [esp]
add esp, 4
push 0
push 0
push 0x406028
push 0x406024
push 0x406020
call sub.CRTDLL.DLL___GetMainArgs
push dword [0x406028]
push dword [0x406024]
push dword [0x406020]
mov dword [0x406014], esp
call fcn.0040129c
add esp, 0x18
xor ecx, ecx
mov dword [ebp - 4], ecx
push eax
call sub.CRTDLL.DLL_exit
leave
ret

Function at 0x40129c
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x88
push ebx
push esi
push edi
xor edi, edi
mov dword [ebp - 0x84], 0
call fcn.004019a4
mov edi, eax
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
mov eax, edi
or al, 0x40
push eax
lea eax, [0x4046d1]
lea edx, [fcn.00401a14]
sub eax, edx
push eax
push fcn.00401a14
call sub.KERNEL32.dll_VirtualProtect
cmp dword [ebp - 4], 0
je 0x40132e
push edi
call fcn.00401894
lea eax, [ebp - 0x84]
push eax
push edi
call fcn.004018e3
mov eax, edi
add eax, 0x1e200
mov dword [ebp - 0x88], eax
lea eax, [ebp - 0x84]
push eax
mov esi, dword [ebp - 0x88]
mov ecx, esi
mov ebx, edi
sar ebx, cl
sub esi, ebx
push esi
lea esi, [0x4060e4]
xor esi, edi
push esi
call fcn.00401a14
add esp, 0x18
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x4019a4
Capabilities:
Encode data using base64 via winapi

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x224
push edi
and dword [ebp - 0x120], 0
xor edi, edi
mov dword [ebp - 0x11c], 0x14
mov byte [ebp - 0x104], 0
lea eax, [ebp - 0x11c]
push eax
lea eax, [ebp - 0x118]
push eax
push 1
push 1
lea eax, [ebp - 0x104]
push eax
call sub.CRYPT32.DLL_CryptBinaryToStringW
push 0
push 0
call sub.SHLWAPI.DLL_PathAppendA
movzx eax, word [ebp - 0x118]
mov edi, eax
sub edi, 0x41
mov eax, edi
pop edi
leave
ret
Function at 0x419020
Capabilities:
Create thread

Disassembly:
push esi
lea eax, [esp + 8]
push eax
push 0
mov esi, ecx
mov ecx, dword [esp + 0x10]
push ecx
push edx
push 0
push 0
call sub.MSVCRT.dll__beginthreadex
add esp, 0x18
mov dword [esi], eax
pop esi
test eax, eax
je 0x419048
xor eax, eax
ret 4
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x419057
mov eax, 1
ret 4

Function at 0x48f9e0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x7c000]
push edi
jmp 0x48f9fa
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x48fa01
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x48f9f0
mov eax, 1
add ebx, ebx
jne 0x48fa13
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x48fa24
jne 0x48fa43
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x48fa43
dec eax
add ebx, ebx
jne 0x48fa30
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x48fa08
add ebx, ebx
jne 0x48fa3f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x48fa95
xor ecx, ecx
sub eax, 3
jb 0x48fa5b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x48faca
sar eax, 1
mov ebp, eax
jmp 0x48fa66
add ebx, ebx
jne 0x48fa66
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x48fa34
inc ecx
add ebx, ebx
jne 0x48fa74
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x48fa34
add ebx, ebx
jne 0x48fa81
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x48fa76
jne 0x48fa92
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x48fa76
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x48fab4
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x48faa6
jmp 0x48f9f6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x48fab4
add edi, ecx
jmp 0x48f9f6
pop esi
mov edi, esi
mov ecx, 0x1a9e
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x48fad2
cmp byte [edi], 6
jne 0x48fad2
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x48fad7
lea edi, [esi + 0x8d000]
mov eax, dword [edi]
or eax, eax
je 0x48fb4f
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x8f000]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x8f104]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x48fb04
mov ecx, edi
jns 0x48fb33
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x8f108]
or eax, eax
je 0x48fb49
mov dword [ebx], eax
add ebx, 4
jmp 0x48fb21
call dword [esi + 0x8f118]
mov ebp, dword [esi + 0x8f10c]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x207]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x48fb83
sub esp, 0xffffff80
jmp section.UPX0