joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42b988
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
test esi, esi
jne 0x42b996
mov eax, 0xffffff53
pop esi
ret
mov eax, dword [esi + 0x60]
push ebx
push edi
lea edi, [esi + 0x20]
mov byte [edi + eax], 0x80
inc dword [esi + 0x60]
mov ecx, dword [esi + 0x60]
push 0x38
pop ebx
cmp ecx, ebx
jbe 0x42b9e3
push 0x40
pop eax
sub eax, ecx
push eax
lea eax, [ecx + edi]
push 0
push eax
call fcn.0042ec60
push 0x40
pop eax
push eax
mov edx, edi
mov dword [esi + 0x60], eax
mov ecx, edi
call fcn.0042b22e
add esp, 0x10
mov edx, edi
mov ecx, esi
call fcn.0042b2c5
test eax, eax
jne 0x42ba31
and dword [esi + 0x60], eax
mov eax, dword [esi + 0x60]
sub ebx, eax
push ebx
add eax, edi
push 0
push eax
call fcn.0042ec60
mov ecx, dword [esi + 0x64]
mov edx, edi
mov eax, dword [esi + 0x68]
shr ecx, 0x1d
push 0x40
lea eax, [ecx + eax*8]
mov ecx, edi
mov dword [esi + 0x68], eax
mov eax, dword [esi + 0x64]
shl eax, 3
mov dword [esi + 0x64], eax
call fcn.0042b22e
mov eax, dword [esi + 0x68]
add esp, 0x10
mov dword [edi + 0x38], eax
mov edx, edi
mov eax, dword [esi + 0x64]
mov ecx, esi
mov dword [edi + 0x3c], eax
pop edi
pop ebx
pop esi
jmp fcn.0042b2c5
pop edi
pop ebx
pop esi
ret

Function at 0x42ba35
Capabilities:
Hash data using sha256

Disassembly:
push ebx
mov ebx, ecx
push edi
mov edi, edx
test ebx, ebx
je 0x42ba6a
test edi, edi
je 0x42ba6a
call fcn.0042b988
test eax, eax
jne 0x42ba6f
push esi
push 0x20
mov edx, ebx
mov ecx, ebx
call fcn.0042b22e
pop ecx
push 8
pop ecx
mov esi, ebx
rep movsd dword es:[edi], dword [esi]
pop esi
pop edi
mov ecx, ebx
pop ebx
jmp 0x42b25b
mov eax, 0xffffff53
pop edi
pop ebx
ret

Function at 0x42bb24
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov eax, edx
mov esi, ecx
neg eax
mov dword [ebp - 8], esi
mov dword [ebp - 4], eax
test esi, esi
je 0x42bbc1
mov ebx, dword [ebp + 8]
test ebx, ebx
je 0x42bbc1
mov edx, dword [esi]
mov ecx, ebx
inc edx
call fcn.00427471
mov dword [ebp - 0xc], eax
test eax, eax
jne 0x42bbc6
xor edx, edx
push edi
cmp dword [esi], edx
jle 0x42bb86
mov edi, dword [ebx + 0xc]
mov ecx, esi
call fcn.0042bb0e
mov ecx, ebx
mov esi, eax
call fcn.0042bb0e
mov ecx, dword [ebp - 4]
xor esi, eax
and esi, ecx
xor dword [edi + edx*4], esi
inc edx
mov esi, dword [ebp - 8]
cmp edx, dword [esi]
jl 0x42bb5f
jmp 0x42bbac
mov ecx, dword [ebp - 4]
jmp 0x42bbac
mov edi, dword [ebx + 0xc]
mov ecx, esi
call fcn.0042bb0e
mov ecx, ebx
mov esi, eax
call fcn.0042bb0e
mov ecx, dword [ebp - 4]
xor esi, eax
and esi, ecx
xor dword [edi + edx*4], esi
inc edx
mov esi, dword [ebp - 8]
cmp edx, dword [ebx]
jl 0x42bb8b
mov eax, dword [ebp - 8]
pop edi
mov eax, dword [eax]
xor eax, dword [ebx]
and eax, ecx
xor dword [ebx], eax
mov eax, dword [ebp - 0xc]
jmp 0x42bbc6
mov eax, 0xffffff53
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x43e978
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0043e7f7

Function at 0x441c2f
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0044159d
Function at 0x441c3a
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004417d8
Function at 0x418c11
Capabilities:
Encode data using xor

Disassembly:
sbb eax, 0xc9701df1
in eax, dx
dec ebx
cld
fcmovnbe st(0), st(7)
mov cl, 0x79
xor ecx, ebp
int 0xd0
adc byte [eax + 0x58], dl
mov dword [0xbe4103d8], eax
test dword [eax], ebx
sub cl, byte [ecx]
dec edi
mov edx, 0x3d0d38bc
mov esp, 0x123d0d38
dec ebp
xor ch, byte [edx + 0x52]
jo 0x418bdc
mov ecx, dword [edx + ecx*4]
xor eax, 0x42d2f200
cmp ch, byte [ecx - 9]
fnstcw word [esi]
sub edi, eax

Function at 0x419410
Capabilities:
Get disk information

Disassembly:
sub esp, 8
mov eax, dword [0x4d1030]
mov edx, dword [0x4d1034]
invalid
inc esp
and al, 4
add byte [eax], al
invalid

Function at 0x43155d
Capabilities:
Encode data using xor

Disassembly:
dec edx
lcall 0x5cf3, 0x9bc78b42
mov esi, 0xc2351104
out dx, al
psubusb mm0, mm4
invalid
mov ecx, 0x69b9047d
rol byte [ebx + eax*4], 1
popal
lodsb al, byte [esi]
mov dword [ebx - 0x58782f6c], esi
sbb dh, byte [eax + 0x5d4d2084]
insd dword es:[edi], dx
xchg byte [edi], bl
pop ecx
push 0xed9adbc2
xlatb
adc dl, bl
pop eax
mov ebp, 0x52cdd7c9
pop ds
or ch, bh
mov al, byte [0x2149b89b]
arpl word [ebp - 0x55], bx
dec esi
loope 0x431504
sub dword [esi], ebx
cld
pop ecx
add byte [edx + eax*2 - 0x365d42d4], 2
mov byte [0x1b6f02c9], al
nop
mov ah, 0xdc
sub byte [eax + 0x4af90dda], cl
jp 0x43151e
mov byte [0x1b6f02c9], al
nop
mov ah, 0xdc
sub byte [eax + 0x4af90dda], cl
jp 0x43151e
mov dl, 0xb5
ret

Function at 0x4c6ecd
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x4d1398
cmp edx, dword [eax]
je 0x4c6eef
add eax, 8
inc ecx
cmp eax, 0x4d1428
jl 0x4c6ee0
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x4d1398]
jne 0x4c701d
mov eax, dword [0x4d6dc0]
cmp eax, 1
je 0x4c6ff7
test eax, eax
jne 0x4c6f20
cmp dword [0x4d12c4], 1
je 0x4c6ff7
cmp edx, 0xfc
je 0x4c701d
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4c6f57
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.004c78b0
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.004c7d40
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x4c6f9a
lea eax, [ebp - 0x1a4]
push eax
call fcn.004c7d40
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x4cce24
push edi
call fcn.004c9c10
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.004c78b0
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.004c78c0
lea eax, [ebp - 0xa0]
push 0x4cce04
push eax
call fcn.004c78c0
push dword [esi + 0x4d139c]
lea eax, [ebp - 0xa0]
push eax
call fcn.004c78c0
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.004c9b84
add esp, 0x2c
pop edi
jmp 0x4c701d
lea eax, [ebp + 8]
lea esi, [esi + 0x4d139c]
push 0
push eax
push dword [esi]
call fcn.004c7d40
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x49e1ac4
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp eax, edx
je 0x49e1b1d
test eax, edx
je 0x49e1b20
movzx ecx, word [edx]
cmp cx, word [eax]
je 0x49e1adb
movzx eax, word [eax]
sub eax, ecx
jmp 0x49e1b02
push ebx
mov ebx, dword [eax - 4]
xor ecx, ecx
sub ebx, dword [edx - 4]
push ebx
adc ecx, 0xffffffff
and ecx, ebx
sub ecx, dword [eax - 4]
shl ecx, 1
sub eax, ecx
sub edx, ecx
mov ebx, dword [ecx + eax]
xor ebx, dword [ecx + edx]
jne 0x49e1b03
add ecx, 4
js 0x49e1af3
pop eax
pop ebx
ret
bsf ebx, ebx
shr ebx, 4
add ebx, ebx
add ecx, ebx
jns 0x49e1b00
movzx eax, word [ecx + eax]
movzx edx, word [ecx + edx]
sub eax, edx
pop ebx
pop ebx
jmp 0x49e1b02
xor eax, eax
ret
test eax, eax
je 0x49e1b2c
test edx, edx
jne 0x49e1acc
mov eax, dword [eax - 4]
ret
sub eax, dword [edx - 4]
ret

Function at 0x49eab98
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffdf8
mov ebx, eax
mov eax, ebx
call fcn.049c94bc
mov ebp, eax
push ebp
push 0
push 0
mov ecx, ebx
xor edx, edx
mov eax, 0xfde9
call fcn.049cd278
mov edi, eax
cmp edi, 0x104
jbe 0x49eab43
mov eax, edi
add eax, eax
call fcn.049c5d48
mov esi, eax
jmp 0x49eab45
mov esi, esp
push ebp
push esi
push edi
mov ecx, ebx
xor edx, edx
mov eax, 0xfde9
call fcn.049cd278
push esi
call fcn.049d2400
xor ebx, ebx
mov eax, edi
dec eax
test eax, eax
jl 0x49eab7e
inc eax
xor edx, edx
mov ecx, ebx
shl ecx, 5
shr ebx, 0x1b
or ecx, ebx
mov ebx, ecx
movzx ecx, word [esi + edx*2]
xor ebx, ecx
inc edx
dec eax
jne 0x49eab68
mov eax, esp
cmp esi, eax
je 0x49eab8b
mov eax, esi
call fcn.049c5d64
mov eax, ebx
add esp, 0x208
pop ebp
pop edi
pop esi
pop ebx
ret
push esi
push ebx
mov esi, eax
xor eax, eax
push esi
rol eax, 5
mov bl, byte [esi]
test bl, 0x80
jne 0x49eabc4
cmp bl, 0
je 0x49eabc0
cmp bl, 0x41
jl 0x49eabbb
cmp bl, 0x5a
jg 0x49eabbb
or bl, 0x20
xor al, bl
inc esi
jmp 0x49eab9f
pop ecx
pop ebx
pop esi
ret
pop eax
pop ebx
pop esi
jmp 0x49eab04
Function at 0x4a4b8f0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
mov dl, 0xb5
mov ebx, eax
xor eax, eax
mov ecx, eax
mov esi, ebx
shr esi, cl
mov ecx, esi
and cl, 0xff
xor dl, cl
inc eax
cmp eax, 4
jne 0x4a4b8f8
mov eax, edx
pop esi
pop ebx
ret

Function at 0x4ad0330
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x10], edx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x51108a
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebx + 4], 0
je 0x4ad045f
mov eax, dword [ebx + 4]
mov dl, 1
call fcn.049e309c
test al, al
je 0x4ad045f
push 0x20
mov ecx, dword [ebx + 4]
mov dl, 1
mov eax, dword [0x496f94]
call fcn.04a7967c
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x511058
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
mov edx, dword [eax]
call dword [edx]
mov esi, eax
mov eax, dword [ebp - 0xc]
call fcn.04a7708c
sub esi, eax
push esi
lea eax, [ebp - 4]
mov ecx, 1
mov edx, dword [0x40462c]
call fcn.049cb300
add esp, 4
mov edx, dword [ebp - 4]
mov ecx, esi
mov eax, dword [ebp - 0xc]
mov esi, dword [eax]
call dword [esi + 0xc]
lea edx, [ebx + 0xc]
mov eax, dword [ebp - 4]
call fcn.049eed80
mov esi, eax
mov dl, 1
mov eax, dword [0x494104]
call fcn.04a76fe8
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x51103b
push dword fs:[eax]
mov dword fs:[eax], esp
mov edi, dword [ebp - 4]
test edi, edi
je 0x4ad03fc
sub edi, 4
mov edi, dword [edi]
sub edi, esi
push edi
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebx + 0xc]
mov ecx, esi
mov edx, dword [ebp - 4]
call fcn.049f00d0
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
call dword [ecx + 0x30]
mov edx, dword [ebp - 8]
mov eax, ebx
call fcn.04ad0728
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x511042
mov eax, dword [ebp - 8]
call fcn.049c7264
ret
mov eax, ebx
call fcn.04ad0134
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x511091
lea eax, [ebp - 0x10]
call fcn.049c8fec
lea eax, [ebp - 4]
mov edx, dword [0x40462c]
call fcn.049cb424
ret

Function at 0x4ade288
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x4ade28e
ret
Function at 0x4c3bc94
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
mov ecx, 6
push 0
push 0
dec ecx
jne 0x4c3bc9c
push ecx
push ebx
push esi
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x67ca51
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebx + 4]
mov eax, dword [eax + 0x18]
mov ecx, dword [eax + 0xc]
lea eax, [ebp - 4]
mov edx, 0x67ca6c
call fcn.049c9e78
push esi
mov eax, dword [ebp - 4]
mov dword [ebp - 0x14], eax
mov byte [ebp - 0x10], 0x11
mov eax, dword [ebx + 0x2c]
push eax
lea eax, [ebp - 0x18]
push eax
movzx ecx, word [ebx + 0x30]
xor edx, edx
mov eax, dword [ebx + 0x1c]
call fcn.04c39858
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0xc], eax
mov byte [ebp - 8], 0x11
lea edx, [ebp - 0x14]
mov ecx, 1
mov eax, 0x67ca80
call fcn.04be1794
mov eax, dword [ebx + 0xc]
test eax, eax
je 0x4c3bd17
sub eax, 4
mov eax, dword [eax]
test eax, eax
jle 0x4c3bd58
lea eax, [ebp - 0x1c]
push eax
mov eax, dword [ebx + 0x2c]
push eax
lea eax, [ebp - 0x28]
push eax
movzx ecx, word [ebx + 0x30]
xor edx, edx
mov eax, dword [ebx + 0xc]
call fcn.04c39858
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0x11
lea edx, [ebp - 0x24]
xor ecx, ecx
mov eax, 0x67cae8
call fcn.04be1794
mov edx, dword [ebp - 0x1c]
mov eax, esi
call fcn.049c9e20
mov eax, esi
mov edx, 0x67cb14
call fcn.049c9e20
mov eax, dword [ebx + 0x14]
test eax, eax
je 0x4c3bd70
sub eax, 4
mov eax, dword [eax]
test eax, eax
jle 0x4c3bdde
lea eax, [ebp - 0x2c]
push eax
mov eax, dword [ebx + 0x14]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0x11
lea edx, [ebp - 0x24]
xor ecx, ecx
mov eax, 0x67cb28
call fcn.04be1794
mov edx, dword [ebp - 0x2c]
mov eax, esi
call fcn.049c9e20
mov eax, dword [ebx + 0x10]
test eax, eax
je 0x4c3bda7
sub eax, 4
mov eax, dword [eax]
test eax, eax
jle 0x4c3bdd2
lea eax, [ebp - 0x30]
push eax
mov eax, dword [ebx + 0x10]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0x11
lea edx, [ebp - 0x24]
xor ecx, ecx
mov eax, 0x67cb58
call fcn.04be1794
mov edx, dword [ebp - 0x30]
mov eax, esi
call fcn.049c9e20
mov eax, esi
mov edx, 0x67cb84
call fcn.049c9e20
mov eax, dword [ebx + 0x18]
test eax, eax
je 0x4c3bdea
sub eax, 4
mov eax, dword [eax]
test eax, eax
jle 0x4c3be15
lea eax, [ebp - 0x34]
push eax
mov eax, dword [ebx + 0x18]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0x11
lea edx, [ebp - 0x24]
xor ecx, ecx
mov eax, 0x67cb98
call fcn.04be1794
mov edx, dword [ebp - 0x34]
mov eax, esi
call fcn.049c9e20
mov eax, esi
mov edx, 0x67cbe4
call fcn.049c9e20
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x67ca58
lea eax, [ebp - 0x34]
mov edx, 4
call fcn.049c904c
lea eax, [ebp - 0x1c]
mov edx, 2
call fcn.049c904c
lea eax, [ebp - 4]
call fcn.049c8fec
ret
Function at 0x4c83164
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
cmp byte [0x7d3ee8], 0
jne 0x4c8317b
call fcn.04c83120
mov eax, edi
dec eax
test eax, eax
jl 0x4c831a3
inc eax
xor edx, edx
movzx ecx, byte [esi + edx]
xor ecx, ebx
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x7d3ae8]
shr ebx, 8
xor ecx, ebx
mov ebx, ecx
inc edx
dec eax
jne 0x4c83185
mov eax, ebx
pop edi
pop esi
pop ebx
ret

Function at 0x4c85e98
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov ebx, eax
xor eax, eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov eax, dword [ebx + 0x14]
movzx edx, byte [eax + 0x461]
movzx ecx, dl
cmp ecx, 6
ja 0x4c85fe3
jmp dword [ecx*4 + 0x6c6acb]
mov ecx, dword [eax + 0x468]
mov edx, dword [ebx + 0x1c]
dec edx
imul ecx, edx
mov esi, ecx
add esi, dword [eax + 0x450]
mov dword [ebp - 0xc], esi
mov esi, dword [eax + 0x454]
mov dword [ebp - 8], esi
add ecx, dword [eax + 0x44c]
mov dword [ebp - 0x10], ecx
mov esi, edx
test esi, esi
jb 0x4c8607b
inc esi
mov eax, dword [ebx + 0x20]
inc eax
push eax
lea eax, [ebx + 0x4c]
push eax
mov eax, dword [ebp + 8]
push eax
movzx eax, byte [ebx + 0x48]
mov ecx, dword [ebx + eax*4 + 0x40]
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.04c850ac
test eax, eax
je 0x4c8607b
mov eax, ebx
call fcn.04c86084
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 0x10]
push eax
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
lea edx, [eax + 1]
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x14]
call dword [ebp - 0x18]
movzx eax, byte [ebx + 0x48]
xor al, 1
mov byte [ebx + 0x48], al
mov eax, dword [ebx + 0x14]
mov eax, dword [eax + 0x468]
sub dword [ebp - 0xc], eax
sub dword [ebp - 0x10], eax
mov eax, dword [ebx + 0x18]
add dword [ebp - 8], eax
dec esi
jne 0x4c86014
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x4c86084
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff8
mov ebx, eax
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax]
dec al
je 0x4c860b5
dec al
je 0x4c860f0
dec al
je 0x4c8612d
dec al
je 0x4c86196
jmp 0x4c86220
mov esi, dword [ebx + 0x24]
inc esi
mov edi, dword [ebx + 0x20]
sub edi, esi
jb 0x4c86220
inc edi
mov edx, esi
sub edx, dword [ebx + 0x24]
movzx ecx, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx edx, byte [ecx + edx]
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
add dl, byte [eax + esi]
and dl, 0xff
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x4c860c5
jmp 0x4c86220
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x4c86220
mov esi, 1
movzx eax, byte [ebx + 0x48]
mov ecx, eax
xor cl, 1
and ecx, 0x7f
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx ecx, byte [ecx + esi]
movzx edx, al
mov edx, dword [ebx + edx*4 + 0x40]
add cl, byte [edx + esi]
and cl, 0xff
mov byte [edx + esi], cl
inc esi
dec edi
jne 0x4c86100
jmp 0x4c86220
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x4c86220
mov esi, 1
movzx eax, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov ecx, esi
dec ecx
mov edx, dword [ebx + 0x24]
cmp ecx, edx
jae 0x4c8615c
xor ebp, ebp
jmp 0x4c8616c
mov ecx, esi
sub ecx, edx
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx ebp, byte [edx + ecx]
add eax, ebp
sar eax, 1
jns 0x4c86175
adc eax, 0
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
add al, byte [edx + esi]
and al, 0xff
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
mov byte [edx + esi], al
inc esi
dec edi
jne 0x4c8613d
jmp 0x4c86220
xor ebp, ebp
xor eax, eax
mov dword [esp + 4], eax
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x4c86220
mov esi, 1
movzx eax, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov edx, esi
dec edx
cmp edx, dword [ebx + 0x24]
jb 0x4c861ef
mov edx, esi
sub edx, dword [ebx + 0x24]
movzx ecx, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx ebp, byte [ecx + edx]
movzx edx, byte [ebx + 0x48]
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
mov ecx, esi
sub ecx, dword [ebx + 0x24]
movzx edx, byte [edx + ecx]
mov dword [esp + 4], edx
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx edx, byte [edx + esi]
mov dword [esp], edx
movzx ecx, byte [esp + 4]
push eax
mov eax, ebp
pop edx
call fcn.04c831ac
add al, byte [esp]
and al, 0xff
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
mov byte [edx + esi], al
inc esi
dec edi
jne 0x4c861aa
pop ecx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4c8dd98
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x14], 0xca
jne 0x4c8ddc6
mov eax, ebx
call fcn.04c8e854
cmp dword [ebx + 0x40], 0
je 0x4c8ddbf
mov dword [ebx + 0x14], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x14], 0xcb
cmp dword [ebx + 0x14], 0xcb
jne 0x4c8de37
mov edx, dword [ebx + 0x1b4]
cmp dword [edx + 0x10], 0
je 0x4c8de29
cmp dword [ebx + 8], 0
je 0x4c8dde8
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1b4]
call dword [edx]
test eax, eax
jne 0x4c8ddfa
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x4c8de29
cmp dword [ebx + 8], 0
je 0x4c8dddb
cmp eax, 3
je 0x4c8de0d
dec eax
jne 0x4c8dddb
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x4c8dddb
mov edx, dword [ebx + 0x140]
add dword [eax + 8], edx
jmp 0x4c8dddb
mov ecx, dword [ebx + 0x90]
mov dword [ebx + 0x98], ecx
jmp 0x4c8de55
cmp dword [ebx + 0x14], 0xcc
je 0x4c8de55
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x14
mov edx, dword [ebx + 0x14]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.04c8de60
pop ebx
ret
Function at 0x430000
Capabilities:
Encode data using xor

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
nop
nop
nop
nop
pop eax
nop
nop
add eax, 0x403d6f
sub eax, 0x403d15
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x430030
nop
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x43001e
nop
nop
nop
nop
nop
popal
nop
nop
jmp loc.00401219
Function at 0x40bc90
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0xa000]
push edi
jmp 0x40bcaa
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x40bcb1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x40bca0
mov eax, 1
add ebx, ebx
jne 0x40bcc3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x40bcb8
jne 0x40bcd4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x40bcb8
xor ecx, ecx
sub eax, 3
jb 0x40bce8
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x40bd5a
mov ebp, eax
add ebx, ebx
jne 0x40bcf3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x40bd00
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x40bd24
inc ecx
add ebx, ebx
jne 0x40bd10
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x40bd05
jne 0x40bd21
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x40bd05
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x40bd44
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x40bd35
jmp 0x40bca6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x40bd44
add edi, ecx
jmp 0x40bca6
pop esi
mov edi, esi
mov ecx, 0x16
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x40bd62
cmp byte [edi], 2
jne 0x40bd62
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x40bd67
lea edi, [esi + 0x9000]
mov eax, dword [edi]
or eax, eax
je 0x40bdd6
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xf71c]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xf7dc]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x40bd94
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xf7e4]
or eax, eax
je 0x40bdd0
mov dword [ebx], eax
add ebx, 4
jmp 0x40bdb1
call dword [esi + 0xf7e0]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x40be07
cmp al, 0xef
ja 0x40bdfa
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x40bddc
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x40bde9
mov ebp, dword [esi + 0xf7e8]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x207]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x40be3b
sub esp, 0xffffff80
jmp 0x401b90