joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10006590
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x1003b068]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
cmp ebx, 0xffffffff
jne 0x100065c0
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10011911
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esi + 0x20]
push edi
mov ecx, dword [eax]
test ecx, ecx
je 0x100065fc
mov edx, dword [esi + 0x30]
mov edi, dword [edx]
lea eax, [edi + ecx]
cmp ecx, eax
jae 0x100065fc
lea ecx, [edi - 1]
mov dword [edx], ecx
mov edx, dword [esi + 0x20]
mov esi, dword [edx]
lea ecx, [esi + 1]
mov dword [edx], ecx
mov byte [esi], bl
pop edi
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10011911
mov esp, ebp
pop ebp
ret 4
cmp dword [esi + 0x4c], 0
je 0x100066e3
mov edi, dword [esi + 0xc]
lea eax, [esi + 0x3c]
cmp dword [edi], eax
jne 0x10006624
mov edx, dword [esi + 0x54]
mov ecx, dword [esi + 0x50]
sub edx, ecx
mov dword [edi], ecx
mov eax, dword [esi + 0x1c]
mov dword [eax], ecx
mov eax, dword [esi + 0x2c]
mov dword [eax], edx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x10006657
push dword [esi + 0x4c]
movsx eax, bl
push eax
call fcn.10016637
add esp, 8
or ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10011911
mov esp, ebp
pop ebp
ret 4
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x25], bl
mov edx, dword [ecx]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x25]
push eax
lea eax, [esi + 0x40]
push eax
call dword [edx + 0x1c]
test eax, eax
js 0x100066e3
cmp eax, 1
jle 0x100066b6
cmp eax, 3
jne 0x100066e3
push dword [esi + 0x4c]
movsx eax, byte [ebp - 0x25]
push eax
call fcn.10016637
add esp, 8
or ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10011911
mov esp, ebp
pop ebp
ret 4
mov edi, dword [ebp - 0x2c]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x100066d3
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.1001733f
add esp, 0x10
cmp edi, eax
jne 0x100066e3
lea eax, [ebp - 0x25]
mov byte [esi + 0x3d], 1
cmp dword [ebp - 0x30], eax
jne 0x100065e7
mov ecx, dword [ebp - 4]
or eax, 0xffffffff
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10011911
mov esp, ebp
pop ebp
ret 4
Function at 0x100075a0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x1003b068]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
push edi
cmp dword [esi + 0x38], 0
je 0x10007641
cmp byte [esi + 0x3d], 0
je 0x10007641
mov eax, dword [esi]
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
je 0x100075f7
mov ecx, dword [esi + 0x38]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 4]
push eax
mov edx, dword [ecx]
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call dword [edx + 0x20]
sub eax, 0
je 0x10007609
sub eax, 1
je 0x1000760d
sub eax, 2
je 0x10007641
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10011911
mov esp, ebp
pop ebp
ret
mov byte [esi + 0x3d], 0
mov edi, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x1000762a
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.1001733f
add esp, 0x10
cmp edi, eax
jne 0x100075f7
cmp byte [esi + 0x3d], 0
pop edi
sete al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10011911
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, 1
pop edi
xor ecx, ebp
pop esi
call fcn.10011911
mov esp, ebp
pop ebp
ret

Function at 0x10008b10
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
mov edx, 0x811c9dc5
push edi
mov edi, dword [ebp + 8]
mov ecx, 0
sub esi, edi
je 0x10008b41
nop dword [eax]
movzx eax, byte [ecx + edi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, esi
jb 0x10008b30
pop edi
mov eax, edx
pop esi
pop ebp
ret 8
Function at 0x1000c830
Capabilities:
Parse credit card information

Disassembly:
push ecx
push ebx
push esi
mov esi, ecx
xor cl, cl
mov eax, dword [esi + 0x4c]
cmp eax, 0xffffffff
je 0x1000ca40
cmp eax, 0x7c
je 0x1000ca40
cmp eax, 0x29
jne 0x1000c871
cmp dword [esi + 0x10], 0
jne 0x1000ca40
cmp eax, eax
jne 0x1000c871
test dword [esi + 0x50], 0x10000000
je 0x1000ca4d
jmp 0x1000c9f9
cmp eax, 0x2e
jne 0x1000c882
push 5
lea ecx, [esi + 0x24]
call fcn.1000cab0
jmp 0x1000c8fb
cmp eax, 0x5c
jne 0x1000c8de
mov ecx, esi
call fcn.1000c7d0
test byte [esi + 0x50], 0x80
je 0x1000c8d2
mov al, byte [esi + 0x48]
cmp al, 0x62
jne 0x1000c8b1
push 4
lea ecx, [esi + 0x24]
call fcn.1000cab0
mov ecx, esi
call fcn.1000c7d0
jmp 0x1000ca32
cmp al, 0x42
jne 0x1000c8d2
push 4
lea ecx, [esi + 0x24]
call fcn.1000cab0
mov eax, dword [esi + 0x28]
mov ecx, esi
xor dword [eax + 8], 1
call fcn.1000c7d0
jmp 0x1000ca32
mov ecx, esi
call fcn.1000dc60
jmp 0x1000ca2b
cmp eax, 0x5b
jne 0x1000c946
mov ecx, esi
call fcn.1000c7d0
mov ecx, esi
call fcn.1000db70
cmp dword [esi + 0x4c], 0x5d
jne 0x1000ca5b
mov edx, dword [esi + 8]
mov eax, dword [esi]
cmp eax, edx
je 0x1000c93a
cmp byte [eax], 0x5c
jne 0x1000c937
lea ecx, [eax + 1]
cmp ecx, edx
je 0x1000c937
mov edx, dword [esi + 0x50]
test dl, 8
jne 0x1000c924
mov bl, byte [ecx]
cmp bl, 0x28
je 0x1000c935
cmp bl, 0x29
je 0x1000c935
test dl, 0x10
jne 0x1000c937
mov dl, byte [ecx]
cmp dl, 0x7b
je 0x1000c935
cmp dl, 0x7d
jne 0x1000c937
mov eax, ecx
inc eax
mov dword [esi], eax
mov ecx, esi
call fcn.1000acb0
jmp 0x1000ca2b
cmp eax, 0x28
jne 0x1000c9b5
mov ecx, esi
call fcn.1000c7d0
mov ecx, esi
call fcn.1000de00
cmp dword [esi + 0x4c], 0x29
mov bh, al
jne 0x1000ca4d
mov eax, dword [esi]
mov edx, dword [esi + 8]
cmp eax, edx
je 0x1000c9a4
cmp byte [eax], 0x5c
jne 0x1000c9a1
lea ecx, [eax + 1]
cmp ecx, edx
je 0x1000c9a1
mov edx, dword [esi + 0x50]
test dl, 8
jne 0x1000c98e
mov bl, byte [ecx]
cmp bl, 0x28
je 0x1000c99f
cmp bl, 0x29
je 0x1000c99f
test dl, 0x10
jne 0x1000c9a1
mov dl, byte [ecx]
cmp dl, 0x7b
je 0x1000c99f
cmp dl, 0x7d
jne 0x1000c9a1
mov eax, ecx
inc eax
mov dword [esi], eax
mov ecx, esi
call fcn.1000acb0
test bh, bh
je 0x1000ca32
jmp 0x1000ca2b
cmp eax, 0x5e
jne 0x1000c9cd
push 2
lea ecx, [esi + 0x24]
call fcn.1000cab0
mov ecx, esi
call fcn.1000c7d0
jmp 0x1000ca32
cmp eax, 0x24
jne 0x1000c9e5
push 3
lea ecx, [esi + 0x24]
call fcn.1000cab0
mov ecx, esi
call fcn.1000c7d0
jmp 0x1000ca32
cmp eax, 0x2a
je 0x1000ca46
cmp eax, 0x2b
je 0x1000ca46
cmp eax, 0x3f
je 0x1000ca46
cmp eax, 0x7b
je 0x1000ca46
cmp eax, 0x7d
jne 0x1000ca09
test dword [esi + 0x50], 0x10000000
je 0x1000ca54
jmp 0x1000ca17
cmp eax, 0x5d
jne 0x1000ca17
test dword [esi + 0x50], 0x10000000
je 0x1000ca5b
movzx eax, byte [esi + 0x48]
lea ecx, [esi + 0x24]
push eax
call fcn.1000e0b0
mov ecx, esi
call fcn.1000c7d0
mov ecx, esi
call fcn.1000df10
mov eax, dword [esi + 0x4c]
mov cl, 1
cmp eax, 0xffffffff
jne 0x1000c843
pop esi
mov al, cl
pop ebx
pop ecx
ret
push 0xa
call fcn.1000aca0
push 5
call fcn.1000aca0
push 6
call fcn.1000aca0
push 4
call fcn.1000aca0
int3
Function at 0x1001d7fd
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.1001d673

Function at 0x630db290
Capabilities:
Packed with generic packer

Disassembly:
cmp byte [esp + 8], 1
jne 0x630db454
pushal
mov esi, 0x630d7015
lea edi, [esi - 0x16015]
push edi
or ebp, 0xffffffff
jmp 0x630db2ba
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x630db2c1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x630db2b0
mov eax, 1
add ebx, ebx
jne 0x630db2d3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x630db2c8
jne 0x630db2e4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x630db2c8
xor ecx, ecx
sub eax, 3
jb 0x630db2f8
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x630db36a
mov ebp, eax
add ebx, ebx
jne 0x630db303
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x630db310
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x630db334
inc ecx
add ebx, ebx
jne 0x630db320
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x630db315
jne 0x630db331
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x630db315
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x630db354
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x630db345
jmp 0x630db2b6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x630db354
add edi, ecx
jmp 0x630db2b6
pop esi
mov edi, esi
mov ecx, 0xb8
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x630db372
cmp byte [edi], 0
jne 0x630db372
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x630db377
lea edi, [esi + 0x19000]
mov eax, dword [edi]
or eax, eax
je 0x630db3e6
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x1b000]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x1b050]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x630db3a4
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x1b054]
or eax, eax
je 0x630db3e0
mov dword [ebx], eax
add ebx, 4
jmp 0x630db3c1
popal
xor eax, eax
ret 0xc
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x630db417
cmp al, 0xef
ja 0x630db40a
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x630db3ec
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x630db3f9
mov ebp, dword [esi + 0x1b058]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x19f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x630db44b
sub esp, 0xffffff80
jmp 0x630c2a60
Function at 0x40167e
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x2d0ca34]
sub esp, 0x400
push esi
mov esi, eax
shr esi, 3
push edi
mov edi, dword [0x2d0c42c]
test esi, esi
je 0x4016c9
cmp eax, 0x959
jne 0x4016b5
push 0
lea eax, [ebp - 0x400]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov ecx, edi
call fcn.00401481
add edi, 8
dec esi
je 0x4016c9
mov eax, dword [0x2d0ca34]
jmp 0x40169d
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x40d7a6
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x419458]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.00404d65
mov dword [ebp - 0x14], eax
cmp dword [0x433b48], esi
jne 0x40d899
push 0x800
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x40d826
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x40d979
push esi
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x40d979
push str.MessageBoxW
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40d979
push eax
call ebx
push str.GetActiveWindow
push edi
mov dword [0x433b48], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0x433b4c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x433b50], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x433b58], eax
test eax, eax
je 0x40d896
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x433b54], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x40d8be
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x40d8b1
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x40d8d3
push 4
pop eax
jmp 0x40d97b
cmp dword [ebp - 0x14], esi
je 0x40d8d3
push dword [0x433b48]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x40d8b8
mov eax, dword [0x433b54]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x40d931
cmp dword [0x433b58], edi
je 0x40d931
push eax
call ebx
push dword [0x433b58]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x40d931
test eax, eax
je 0x40d931
call ecx
test eax, eax
je 0x40d926
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x40d926
test byte [ebp - 8], 1
jne 0x40d931
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x40d961
mov eax, dword [0x433b4c]
cmp eax, edi
je 0x40d95e
push eax
call ebx
test eax, eax
je 0x40d95e
call eax
mov esi, eax
test esi, esi
je 0x40d95e
mov eax, dword [0x433b50]
cmp eax, edi
je 0x40d95e
push eax
call ebx
test eax, eax
je 0x40d95e
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x433b48]
call ebx
test eax, eax
je 0x40d979
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x40d97b
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00403fd7
mov esp, ebp
pop ebp
ret
Function at 0x4638f0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x44000]
push edi
jmp 0x46390a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x463911
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x463900
mov eax, 1
add ebx, ebx
jne 0x463923
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x463934
jne 0x463953
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x463953
dec eax
add ebx, ebx
jne 0x463940
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x463918
add ebx, ebx
jne 0x46394f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x4639a5
xor ecx, ecx
sub eax, 3
jb 0x46396b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x4639da
sar eax, 1
mov ebp, eax
jmp 0x463976
add ebx, ebx
jne 0x463976
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x463944
inc ecx
add ebx, ebx
jne 0x463984
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x463944
add ebx, ebx
jne 0x463991
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x463986
jne 0x4639a2
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x463986
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x4639c4
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x4639b6
jmp 0x463906
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x4639c4
add edi, ecx
jmp 0x463906
pop esi
mov edi, esi
mov ecx, 0x1024
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x4639e2
cmp byte [edi], 0x11
jne 0x4639e2
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x4639e7
lea edi, [esi + 0x60000]
mov eax, dword [edi]
or eax, eax
je 0x463a56
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x64f48]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x64f70]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x463a14
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x64f78]
or eax, eax
je 0x463a50
mov dword [ebx], eax
add ebx, 4
jmp 0x463a31
call dword [esi + 0x64f74]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x463a87
cmp al, 0xef
ja 0x463a7a
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x463a5c
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x463a69
mov ebp, dword [esi + 0x64f7c]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x227]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x463abb
sub esp, 0xffffff80
jmp 0x41cab5
Function at 0x403c16
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
mov eax, 0x401000
call 0x403c16
lcall 0x5de5, 0x8b10c483
jmp loc.0076f698
Function at 0x4ae6c0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x84000]
push edi
jmp 0x4ae6da
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x4ae6e1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4ae6d0
mov eax, 1
add ebx, ebx
jne 0x4ae6f3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x4ae704
jne 0x4ae723
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4ae723
dec eax
add ebx, ebx
jne 0x4ae710
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x4ae6e8
add ebx, ebx
jne 0x4ae71f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x4ae775
xor ecx, ecx
sub eax, 3
jb 0x4ae73b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x4ae7aa
sar eax, 1
mov ebp, eax
jmp 0x4ae746
add ebx, ebx
jne 0x4ae746
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4ae714
inc ecx
add ebx, ebx
jne 0x4ae754
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4ae714
add ebx, ebx
jne 0x4ae761
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x4ae756
jne 0x4ae772
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4ae756
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x4ae794
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x4ae786
jmp 0x4ae6d6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x4ae794
add edi, ecx
jmp 0x4ae6d6
pop esi
mov edi, esi
mov ecx, 0x98c
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x4ae7b2
cmp byte [edi], 0xc
jne 0x4ae7b2
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x4ae7b7
lea edi, [esi + 0xac000]
mov eax, dword [edi]
or eax, eax
je 0x4ae82f
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xb4718]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xb4754]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x4ae7e4
mov ecx, edi
jns 0x4ae813
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xb475c]
or eax, eax
je 0x4ae829
mov dword [ebx], eax
add ebx, 4
jmp 0x4ae801
call dword [esi + 0xb4758]
mov ebp, dword [esi + 0xb4760]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1e7]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x4ae863
sub esp, 0xffffff80
jmp 0x407150
Function at 0x407e15
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42e180]
jne 0x407e1f
repz ret
jmp fcn.0040bc0c

Function at 0x40c470
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
pushal
call 0x40c47f
pop dword [ebp - 0xc]
mov eax, 0xe83e2b83
sub eax, 0xe7fd6704
sub dword [ebp - 0xc], eax
mov dword [ebp - 0x1c], 0xa4547569
add dword [ebp - 0x1c], 0xa9fdcfe2
mov dword [ebp - 0x18], 0x54afca6b
sub dword [ebp - 0x18], 0x227c7e26
mov dword [ebp - 0x14], 0xe5f27a4d
add dword [ebp - 0x14], 0x6659c9e1
mov dword [ebp - 0x10], 0x62937f92
sub dword [ebp - 0x10], 0x62937f92
lea eax, [ebp - 0x1c]
push eax
mov eax, 0x3afa0ebd
add eax, 0xc54821b7
add eax, dword [ebp - 0xc]
call dword [eax]
mov dword [ebp - 0x1c], 0x9ccc57fb
add dword [ebp - 0x1c], 0xd7a6115b
mov dword [ebp - 0x18], 0x7c379ca
add dword [ebp - 0x18], 0x39a8e7ab
mov dword [ebp - 0x14], 0x6f4b8bb3
sub dword [ebp - 0x14], 0xbdc1f47
mov dword [ebp - 0x10], 0x4a1cc8f0
sub dword [ebp - 0x10], 0x4a1cc8f0
lea ebx, [ebp - 0x1c]
push ebx
push eax
mov eax, 0xd9788812
add eax, 0x26c9a912
add eax, dword [ebp - 0xc]
call dword [eax]
push 0x40
push 0x1000
push 0x3e633
push 0
call eax
mov ecx, 0x3ef67384
sub ecx, 0x3ef628b4
mov edi, eax
mov ebx, 0xd884d1d
sub ebx, 0xd45091d
add ebx, dword [ebp - 0xc]
mov esi, 0xa8fb8bd5
xor dword [ebp - 8], 0xf6952587
mov edx, dword [ebx]
sub edx, esi
mov dword [ebp - 8], 0xa8967f20
mov dword [edi], edx
xor dword [ebp - 8], 0xe7d1a74b
add edi, 4
add ebx, 4
loop 0x40c59b
add eax, 0x61334309
add eax, 0x9ecddb0a
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x400000
add ecx, dword [ebp - 0xc]
call ebx
leave
ret
Function at 0x5f77a0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x1a8000]
push edi
or ebp, 0xffffffff
jmp 0x5f77c2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x5f77c9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x5f77b8
mov eax, 1
add ebx, ebx
jne 0x5f77db
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x5f77ec
jne 0x5f780b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x5f780b
dec eax
add ebx, ebx
jne 0x5f77f8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x5f77d0
add ebx, ebx
jne 0x5f7807
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x5f785d
xor ecx, ecx
sub eax, 3
jb 0x5f7823
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x5f7892
sar eax, 1
mov ebp, eax
jmp 0x5f782e
add ebx, ebx
jne 0x5f782e
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x5f77fc
inc ecx
add ebx, ebx
jne 0x5f783c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x5f77fc
add ebx, ebx
jne 0x5f7849
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x5f783e
jne 0x5f785a
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x5f783e
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x5f787c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x5f786e
jmp 0x5f77be
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x5f787c
add edi, ecx
jmp 0x5f77be
pop esi
mov edi, esi
mov ecx, 0x111d6a
mov al, 0xe8
repne scasb al, byte es:[edi]
jne 0x5f78b7
cmp byte [edi], 0x11
jne 0x5f789c
mov eax, dword [edi]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
add eax, esi
stosd dword es:[edi], eax
jmp 0x5f789a
lea edi, [esi + 0x1f1000]
mov eax, dword [edi]
or eax, eax
je 0x5f78ff
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x1f71dc]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x1f7218]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x5f78bd
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x1f7220]
or eax, eax
je 0x5f78f9
mov dword [ebx], eax
add ebx, 4
jmp 0x5f78da
call dword [esi + 0x1f721c]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x5f7930
cmp al, 0xef
ja 0x5f7923
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x5f7905
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x5f7912
mov ebp, dword [esi + 0x1f7224]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x21f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x5f7964
sub esp, 0xffffff80
jmp 0x4861b3