joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4bb6b1
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x4c33b8
cmp edx, dword [eax]
je 0x4bb6d3
add eax, 8
inc ecx
cmp eax, 0x4c3448
jl 0x4bb6c4
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x4c33b8]
jne 0x4bb801
mov eax, dword [0x4c8de0]
cmp eax, 1
je 0x4bb7db
test eax, eax
jne 0x4bb704
cmp dword [0x4c32e0], 1
je 0x4bb7db
cmp edx, 0xfc
je 0x4bb801
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4bb73b
lea eax, [ebp - 0x1a4]
push 0x4c09b0
push eax
call fcn.004bc090
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.004bc520
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x4bb77e
lea eax, [ebp - 0x1a4]
push eax
call fcn.004bc520
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x4c09ac
push edi
call fcn.004be3f0
add esp, 0x10
lea eax, [ebp - 0xa0]
push 0x4c0990
push eax
call fcn.004bc090
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.004bc0a0
lea eax, [ebp - 0xa0]
push 0x4c098c
push eax
call fcn.004bc0a0
push dword [esi + 0x4c33bc]
lea eax, [ebp - 0xa0]
push eax
call fcn.004bc0a0
push 0x12010
lea eax, [ebp - 0xa0]
push 0x4c0964
push eax
call fcn.004be364
add esp, 0x2c
pop edi
jmp 0x4bb801
lea eax, [ebp + 8]
lea esi, [esi + 0x4c33bc]
push 0
push eax
push dword [esi]
call fcn.004bc520
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x4017a7
Capabilities:
Hash data with md5

Disassembly:
mov eax, dword [esp + 4]
and dword [eax + 0x14], 0
and dword [eax + 0x10], 0
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
ret
Function at 0x4021fe
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 8]
mov ecx, eax
dec eax
test ecx, ecx
je 0x402217
lea ecx, [eax + 1]
mov eax, dword [esp + 4]
xor byte [eax], 0xa5
inc eax
dec ecx
jne 0x402210
ret
Function at 0x402c6d
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x304
push esi
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov ecx, dword [eax + 0x3c]
xor edx, edx
cmp word [ecx + eax + 0x5c], 2
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp - 0x304]
push dword [ebp + 8]
sete dl
push eax
mov esi, edx
call dword [sym.imp.MSVCRT.dll_vsprintf]
add esp, 0xc
lea eax, [ebp - 0x304]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
test esi, esi
pop esi
je 0x402ce4
lea eax, [ebp - 0x104]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x104]
push 0
push eax
lea eax, [ebp - 0x304]
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov eax, dword [sym.imp.MSVCRT.dll__iob]
add eax, 0x40
push eax
lea eax, [ebp - 0x304]
push eax
call dword [sym.imp.MSVCRT.dll_fputs]
mov eax, dword [sym.imp.MSVCRT.dll__iob]
add eax, 0x40
push eax
push 0xa
call dword [sym.imp.MSVCRT.dll_fputc]
mov eax, dword [sym.imp.MSVCRT.dll__iob]
add eax, 0x40
push eax
call dword [sym.imp.MSVCRT.dll_fflush]
add esp, 0x14
leave
ret

Function at 0x4031af
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x140
push esi
push edi
mov edi, dword [sym.imp.MSVCRT.dll_malloc]
push 0x11c
call edi
push dword [ebp + 8]
mov esi, eax
call sub.MSVCRT.dll_strlen
add eax, 4
push eax
call edi
push dword [ebp + 8]
mov edi, eax
push edi
call sub.MSVCRT.dll_strcpy
push 0x40e820
push edi
call sub.MSVCRT.dll_strcat
add esp, 0x1c
lea eax, [ebp - 0x140]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
push edi
mov edi, dword [sym.imp.MSVCRT.dll_free]
mov dword [esi], eax
call edi
cmp dword [esi], 0xffffffff
pop ecx
jne 0x403259
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jl 0x403229
cmp eax, 3
jle 0x40324b
cmp eax, 8
je 0x40323d
cmp eax, 0x12
je 0x40324b
call dword [sym.imp.MSVCRT.dll__errno]
mov dword [eax], 0x16
push esi
call edi
pop ecx
xor eax, eax
jmp 0x4032a1
call dword [sym.imp.MSVCRT.dll__errno]
mov dword [eax], 0xc
jmp 0x403235
call dword [sym.imp.MSVCRT.dll__errno]
mov dword [eax], 2
jmp 0x403235
mov eax, dword [ebp - 0x140]
sub eax, 0x80
neg eax
sbb eax, eax
and eax, dword [ebp - 0x140]
mov word [esi + 0xa], 0xa
mov word [esi + 8], 0xa
mov dword [esi + 4], eax
mov eax, dword [ebp - 0x120]
mov dword [esi + 0xc], eax
lea eax, [ebp - 0x114]
push eax
lea eax, [esi + 0x10]
push eax
call sub.MSVCRT.dll_strcpy
pop ecx
mov byte [esi + 0x118], 1
pop ecx
mov eax, esi
pop edi
pop esi
leave
ret
Function at 0x403d7d
Capabilities:
Delete directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x400
push ebx
mov ebx, dword [ebp + 8]
push edi
push ebx
call fcn.004031af
mov edi, eax
pop ecx
test edi, edi
je 0x403e45
push esi
push ebx
call sub.MSVCRT.dll_strlen
mov esi, eax
lea eax, [ebp - 0x400]
push esi
push ebx
push eax
call dword [sym.imp.MSVCRT.dll_strncpy]
mov cl, byte [ebp + esi - 0x401]
add esp, 0x10
cmp cl, 0x2f
je 0x403dd4
mov al, byte [0x40d1ac]
cmp cl, al
je 0x403dd4
mov byte [ebp + esi - 0x400], al
inc esi
push edi
call fcn.004032a5
test eax, eax
pop ecx
je 0x403e3d
cmp byte [eax + 0x10], 0x2e
lea ecx, [eax + 0x10]
jne 0x403dfa
mov dl, byte [eax + 0x11]
test dl, dl
je 0x403dd4
cmp dl, 0x2e
jne 0x403dfa
cmp byte [eax + 0x12], 0
je 0x403dd4
lea eax, [ebp + esi - 0x400]
push ecx
push eax
call sub.MSVCRT.dll_strcpy
lea eax, [ebp - 0x400]
push 0x1ff
push eax
call dword [sym.imp.MSVCRT.dll__chmod]
lea eax, [ebp - 0x400]
push eax
call dword [sym.imp.MSVCRT.dll__unlink]
add esp, 0x14
test eax, eax
je 0x403dd4
lea eax, [ebp - 0x400]
push eax
call fcn.00403d7d
pop ecx
jmp 0x403dd4
push edi
call fcn.00403364
pop ecx
pop esi
push ebx
call dword [sym.imp.MSVCRT.dll__rmdir]
pop ecx
pop edi
pop ebx
leave
ret

Function at 0x40489e
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x200
lea eax, [ebp + 0x14]
push eax
lea eax, [ebp - 0x200]
push dword [ebp + 0x10]
push eax
call dword [sym.imp.MSVCRT.dll_vsprintf]
add esp, 0xc
lea eax, [ebp - 0x200]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [ebp + 0xc]
xor ecx, ecx
cmp eax, ecx
je 0x4048ea
cmp byte [eax], cl
je 0x4048ea
push ecx
push eax
lea eax, [ebp - 0x200]
push eax
push ecx
call dword [sym.imp.USER32.dll_MessageBoxA]
leave
ret
push dword [ebp + 8]
lea eax, [ebp - 0x200]
push eax
call dword [sym.imp.MSVCRT.dll_fputs]
push dword [ebp + 8]
call dword [sym.imp.MSVCRT.dll_fflush]
add esp, 0xc
leave
ret
Function at 0x4062bf
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 0x10], 0
mov dword [ebp - 4], 0xffffffff
push 0x14
call sub.MSVCRT.dll_malloc
add esp, 4
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x4062ed
xor eax, eax
jmp 0x4063f7
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp + 8]
mov dword [eax + 4], ecx
mov edx, dword [ebp - 0xc]
mov dword [edx + 8], 1
mov eax, dword [ebp - 0xc]
cmp dword [eax + 4], 0
je 0x40631e
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx + 4]
push edx
call sub.MSVCRT.dll__strdup
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword [ecx + 4], eax
mov edx, dword [ebp - 0xc]
cmp dword [edx + 4], 0
jne 0x40633a
mov eax, dword [ebp - 0xc]
push eax
call sub.MSVCRT.dll_free
add esp, 4
xor eax, eax
jmp 0x4063f7
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x406364
push 2
push 0
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x40636c
jmp 0x4063c8
push 0x40f138
push 0x40f13c
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x4063af
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x4063af
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ecx, dword [ebp - 0xc]
mov dword [ecx], eax
mov edx, dword [ebp - 0xc]
mov eax, dword [edx]
push eax
call fcn.00405c90
add esp, 4
test eax, eax
jne 0x4063c3
jmp 0x4063c8
mov eax, dword [ebp - 0xc]
jmp 0x4063f7
cmp dword [ebp - 4], 0
jl 0x4063da
mov ecx, dword [ebp - 4]
push ecx
call sub.MSVCRT.dll__close
add esp, 4
mov edx, dword [ebp - 0xc]
mov eax, dword [edx + 4]
push eax
call sub.MSVCRT.dll_free
add esp, 4
mov ecx, dword [ebp - 0xc]
push ecx
call sub.MSVCRT.dll_free
add esp, 4
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x406982
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp + 8]
add edx, dword [ecx + 0x3c]
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x10]
xor ecx, ecx
mov cx, word [eax + 0x14]
mov edx, dword [ebp - 0x10]
lea eax, [edx + ecx + 0x18]
mov dword [ebp - 8], eax
mov dword [ebp - 4], 0
jmp 0x4069c8
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 8]
add edx, 0x28
mov dword [ebp - 8], edx
mov eax, dword [ebp - 0x10]
xor ecx, ecx
mov cx, word [eax + 6]
cmp dword [ebp - 4], ecx
jge 0x4069f9
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0xc]
cmp eax, dword [ebp + 0xc]
ja 0x4069f7
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 0xc]
mov eax, dword [ebp - 8]
add edx, dword [eax + 8]
cmp dword [ebp + 0xc], edx
jae 0x4069f7
mov eax, dword [ebp - 8]
jmp 0x4069fb
jmp 0x4069b6
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x407cbc
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x40d1f0
push 0x407e00
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
and dword [ebp - 4], 0
push 1
call dword [sym.imp.MSVCRT.dll___set_app_type]
pop ecx
or dword [0x4108e0], 0xffffffff
or dword [0x4108e4], 0xffffffff
call dword [sym.imp.MSVCRT.dll___p__fmode]
mov ecx, dword [0x410810]
mov dword [eax], ecx
call dword [sym.imp.MSVCRT.dll___p__commode]
mov ecx, dword [0x41080c]
mov dword [eax], ecx
mov eax, dword [sym.imp.MSVCRT.dll__adjust_fdiv]
mov eax, dword [eax]
mov dword [0x4108dc], eax
call fcn.00407dff
cmp dword [0x40f330], 0
jne 0x407d3f
push 0x407dfc
call dword [sym.imp.MSVCRT.dll___setusermatherr]
pop ecx
call fcn.00407dea
push 0x40e00c
push 0x40e008
call sub.MSVCRT.dll__initterm
mov eax, dword [0x410808]
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x28]
push eax
push dword [0x410804]
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.MSVCRT.dll___getmainargs]
push 0x40e004
push section..data
call sub.MSVCRT.dll__initterm
call dword [sym.imp.MSVCRT.dll___p___initenv]
mov ecx, dword [ebp - 0x20]
mov dword [eax], ecx
push dword [ebp - 0x20]
push dword [ebp - 0x2c]
push dword [ebp - 0x1c]
call section..text
add esp, 0x30
mov dword [ebp - 0x24], eax
push eax
call dword [sym.imp.MSVCRT.dll_exit]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov ecx, dword [ecx]
mov dword [ebp - 0x30], ecx
push eax
push ecx
call sub.MSVCRT.dll__XcptFilter
pop ecx
pop ecx
ret
Function at 0x401760
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
push 0
push eax
push 0
push 0
push 0x80000000
push 0x80000000
push 0x80000000
push 0x80000000
push 0xcf0000
push str.Best_Application
push str.Clariot
push 0
mov dword [0x405102], eax
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov esi, eax
test esi, esi
jne 0x4017a7
pop esi
pop ebp
ret
push 0
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
push esi
call dword [sym.imp.USER32.dll_UpdateWindow]
mov eax, 1
pop esi
pop ebp
ret

Function at 0x402028
Capabilities:
Accept command line arguments
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
mov eax, dword [0x405364]
test eax, eax
je 0x402041
call eax
test eax, eax
jne 0x402041
push 0xfffffffffffffffe
jmp 0x40205b
push 1
push 0x405010
push 0x405008
call fcn.00401bd1
add esp, 0xc
test eax, eax
je 0x402061
push 0xfffffffffffffffd
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push esi
push 0
push 0x405004
push section..data
call fcn.00401bd1
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov esi, eax
test esi, esi
jne 0x402087
mov esi, 0x404a52
mov cl, 0x20
jmp 0x402090
cmp al, 0x20
ja 0x40209a
inc esi
mov al, byte [esi]
test al, al
jne 0x40208b
cmp al, 0x20
jbe 0x4020b1
mov al, byte [esi]
cmp al, 0x22
jne 0x4020a3
xor cl, 0x20
inc esi
mov al, byte [esi]
cmp al, cl
ja 0x40209c
jmp 0x4020b1
cmp al, cl
ja 0x4020b7
inc esi
mov al, byte [esi]
test al, al
jne 0x4020ac
and dword [ebp - 0x18], 0
lea eax, [ebp - 0x44]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
test eax, 0xa0d0a0d
sub eax, 0x54524357
sub eax, 0xa0d0a0d
test byte [ebp - 0x18], 1
je 0x4020e0
movzx eax, word [ebp - 0x14]
jmp 0x4020e3
push 0xa
pop eax
push eax
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call main
push eax
call fcn.00402118
pop ecx
pop esi
leave
ret

Function at 0x402118
Capabilities:
Terminate process

Disassembly:
call fcn.00402162
push 0
push 0x405018
push 0x405014
call fcn.00401bd1
push 0
push 0x405020
push 0x40501c
call fcn.00401bd1
add esp, 0x18
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x4021e0
Capabilities:
Get memory capacity

Disassembly:
add esp, 0xffffffe0
mov dword [esp], 0x20
push esp
call sub.KERNEL32.DLL_GlobalMemoryStatus
mov eax, dword [esp + 0xc]
add esp, 0x20
ret

Function at 0x4066a8
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
mov eax, dword [ebp + 8]
push eax
call sub.KERNEL32.DLL_CreateFileA
mov ebx, eax
test eax, eax
je 0x40670a
call fcn.00406658
mov esi, eax
lea eax, [ebp - 4]
push 0
push eax
push esi
call fcn.00402a20
pop ecx
push eax
push esi
push ebx
call sub.KERNEL32.DLL_WriteFile
push 0
lea edx, [ebp - 4]
push edx
push edi
call fcn.00402a20
pop ecx
push eax
push edi
push ebx
call sub.KERNEL32.DLL_WriteFile
push ebx
call sub.KERNEL32.DLL_CloseHandle
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret

Function at 0x406788
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff7c
cmp dword [0x40bc48], 0
push ebx
push esi
mov esi, dword [ebp + 8]
jne 0x406862
cmp dword [0x40bc44], 0
jne 0x406862
cmp dword [0x40be50], 0
je 0x40681c
push 0x80
lea eax, [ebp - 0x84]
push eax
push 0
call sub.KERNEL32.DLL_GetModuleFileNameA
push 0x5c
lea edx, [ebp - 0x84]
push edx
call fcn.00406558
add esp, 8
mov ebx, eax
test eax, eax
jne 0x406802
push 0x3a
lea edx, [ebp - 0x84]
push edx
call fcn.00406558
add esp, 8
mov ebx, eax
test eax, eax
jne 0x406802
lea ebx, [ebp - 0x84]
jmp 0x406803
inc ebx
call fcn.00406744
or eax, 0x10010
push eax
push ebx
push esi
push 0
call sub.USER32.DLL_MessageBoxA
jmp 0x40689d
push 0xfffffffffffffff4
call sub.KERNEL32.DLL_GetStdHandle
mov ebx, eax
lea eax, [ebp - 4]
push 0
push eax
push 2
push 0x40bc4c
push ebx
call sub.KERNEL32.DLL_WriteFile
push 0
lea edx, [ebp - 4]
push edx
push esi
call fcn.00402a20
pop ecx
push eax
push esi
push ebx
call sub.KERNEL32.DLL_WriteFile
push 0
lea ecx, [ebp - 4]
push ecx
push 2
push 0x40bc4f
push ebx
call sub.KERNEL32.DLL_WriteFile
jmp 0x40689d
cmp dword [0x40bc44], 0
je 0x40687c
cmp dword [0x40bc44], 0xffffffff
je 0x40689d
push esi
call dword [0x40bc44]
pop ecx
mov eax, dword [0x40bc48]
test eax, eax
je 0x40689d
cmp dword [0x40bc48], 0xffffffff
je 0x40689d
cmp byte [eax], 0
je 0x40689d
push esi
push eax
call fcn.004066a8
add esp, 8
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4070c0
Capabilities:
Query environment variable

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
cmp dword [0x40cf84], 0
jne 0x407141
cmp dword [0x40cfa4], 0
jne 0x4070f0
call sub.KERNEL32.DLL_GetEnvironmentStrings
mov dword [0x40cfa4], eax
test eax, eax
jne 0x4070f0
push str.GetEnvironmentStrings_failed
call fcn.004068b4
pop ecx
xor ebp, ebp
xor esi, esi
mov ebx, dword [0x40cfa4]
jmp 0x407104
lea eax, [edi + 1]
inc esi
add ebp, eax
add ebx, eax
push ebx
call fcn.00402a20
pop ecx
mov edi, eax
test eax, eax
jne 0x4070fc
lea edi, [ebp + 1]
push edi
call fcn.00401734
pop ecx
mov ebx, eax
mov dword [0x40cf88], ebx
test ebx, ebx
jne 0x40712e
xor eax, eax
jmp 0x407204
push edi
mov edx, dword [0x40cfa4]
push edx
push ebx
call fcn.004028d0
add esp, 0xc
jmp 0x407161
xor esi, esi
mov ebx, dword [0x40cf84]
jmp 0x40715b
push eax
call fcn.00402a20
pop ecx
test eax, eax
jne 0x407157
dec esi
inc esi
add ebx, 4
mov eax, dword [ebx]
test eax, eax
jne 0x40714b
lea ebx, [esi + 4]
push 4
mov dword [0x40cf8c], ebx
inc ebx
push ebx
call fcn.00401298
add esp, 8
test eax, eax
mov dword [esp], eax
jne 0x407184
xor eax, eax
jmp 0x407204
cmp dword [0x40cf84], 0
jne 0x4071b5
xor esi, esi
mov ebx, dword [0x40cf88]
mov eax, dword [esp]
mov ebp, eax
jmp 0x4071a6
mov dword [ebp], ebx
add ebp, 4
inc esi
inc edi
add ebx, edi
push ebx
call fcn.00402a20
pop ecx
mov edi, eax
test eax, eax
jne 0x40719c
jmp 0x4071e6
xor esi, esi
mov ebx, dword [0x40cf84]
mov eax, dword [esp]
mov edi, eax
jmp 0x4071e0
push eax
call fcn.00402a20
pop ecx
test eax, eax
je 0x4071d5
mov eax, dword [ebx]
mov dword [edi], eax
jmp 0x4071d9
dec esi
add edi, 0xfffffffc
add edi, 4
inc esi
add ebx, 4
mov eax, dword [ebx]
test eax, eax
jne 0x4071c4
mov eax, dword [0x40cf84]
test eax, eax
je 0x4071f6
push eax
call fcn.00401744
pop ecx
mov edx, dword [esp]
mov eax, 1
mov dword [0x40cf84], edx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x416000
Capabilities:
Encode data using xor

Disassembly:
call 0x416005
pop ebx
push 0x401005
pop eax
sub ebx, eax
push ebx
pop ebp
lea edi, [ebp + 0x401021]
mov ecx, 0x912a
xor byte [edi], 0xe1
inc edi
loop 0x41601b
or ch, bl
rol ecx, 0xba
mov al, byte [0xbca0acad]
rol ecx, 0x6a
ffree st(5)
or edi, edi
jmp 0x64aa4218
Function at 0x4f3f00
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0xb1000]
push edi
jmp 0x4f3f1a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x4f3f21
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4f3f10
mov eax, 1
add ebx, ebx
jne 0x4f3f33
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x4f3f44
jne 0x4f3f63
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4f3f63
dec eax
add ebx, ebx
jne 0x4f3f50
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x4f3f28
add ebx, ebx
jne 0x4f3f5f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x4f3fb5
xor ecx, ecx
sub eax, 3
jb 0x4f3f7b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x4f3fea
sar eax, 1
mov ebp, eax
jmp 0x4f3f86
add ebx, ebx
jne 0x4f3f86
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4f3f54
inc ecx
add ebx, ebx
jne 0x4f3f94
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4f3f54
add ebx, ebx
jne 0x4f3fa1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x4f3f96
jne 0x4f3fb2
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4f3f96
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x4f3fd4
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x4f3fc6
jmp 0x4f3f16
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x4f3fd4
add edi, ecx
jmp 0x4f3f16
pop esi
mov edi, esi
mov ecx, 0x379b
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x4f3ff2
cmp byte [edi], 0x13
jne 0x4f3ff2
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x4f3ff7
lea edi, [esi + 0xef000]
mov eax, dword [edi]
or eax, eax
je 0x4f406f
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x136c68]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x136dbc]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x4f4024
mov ecx, edi
jns 0x4f4053
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x136dc0]
or eax, eax
je 0x4f4069
mov dword [ebx], eax
add ebx, 4
jmp 0x4f4041
call dword [esi + 0x136dd0]
mov ebp, dword [esi + 0x136dc4]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x217]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x4f40a3
sub esp, 0xffffff80
jmp 0x4165c1
Function at 0x423e1c
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x423e22
ret

Function at 0x47dabe
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 0x20c], ecx
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x47cf6b
push dword fs:[eax]
mov dword fs:[eax], esp
mov edi, ebx
cmp dword [edi + 0xc], 0
jne 0x47db42
cmp dword [esi + 0x1c], 0
je 0x47db42
mov eax, dword [esi + 0x1c]
push dword [eax + 8]
lea eax, [ebp - 0x108]
push eax
lea edx, [ebp - 0x208]
mov eax, dword [edi]
call fcn.004043b4
lea eax, [ebp - 0x208]
mov ecx, 5
mov edx, 2
call fcn.00403548
lea edx, [ebp - 0x108]
lea eax, [ebp - 8]
call fcn.004054b0
push dword [ebp - 8]
lea edx, [ebp - 0x20c]
mov eax, dword [edi + 8]
inc eax
call fcn.00409a60
push dword [ebp - 0x20c]
lea eax, [ebp - 4]
mov edx, 3
call fcn.004055cc
mov edx, dword [ebp - 4]
mov eax, edi
mov ecx, dword [eax]
call dword [ecx + 0x18]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47cf72
lea eax, [ebp - 0x20c]
call fcn.00405254
lea eax, [ebp - 8]
call fcn.00405254
lea eax, [ebp - 4]
call fcn.00405254
ret