joyce8/EMBER2024-capa huggingface dataset:
Function at 0x728d9b
Capabilities:
Encode data using xor

Disassembly:
lea esp, [esp + 8]
jmp fcn.008eb241
shr dword [esp + 4], 0x21
adc esi, 4
xor eax, eax
test edx, edx
lea esp, [esp + 8]
je 0x76e673
push ebx
mov ebx, 0x2a3bb092
sub ebx, ebx
xor bl, byte [edi + ebx*2]
push 0xf2b3f58f
xor ebx, eax
not byte [esp + 1]
xor word [esp + 2], 0xe5b4
and ebx, 0xff
mov ebx, dword [ebx*4 + 0x791120]
not byte [esp + 3]
shr eax, 8
xor eax, ebx
push 0x3799b818
inc edi
sub dword [esp + 4], 0x987e0b0
xor eax, 0xac37e4ba
dec edx
lea esp, [esp + 8]
jne 0x728db5
jmp 0x76e672
pop ebx
push 0x51189c0a
not eax
mov dword [esi], eax
push 0x1134be07
jmp 0x7284ca

Function at 0x875afa
Capabilities:
Encode data using xor

Disassembly:
mov dword [esp + ecx + 4], ecx
xor cl, byte [edi + ecx + 2]
add edi, 2
sar dword [esp + 4], 0xe8
sal al, cl
push 0x433f2b8f
mov word [edi], ax
not dword [esp + 8]
call fcn.00755b66
invalid

Function at 0x8c01b0
Capabilities:
Encode data using xor

Disassembly:
push dword [esp + 8]
popfd
lea esp, [esp + 0xc]
call fcn.008029a3
add byte [edi], cl
sub cl, 0x58
out dx, al
call [esi + 0x36]
xor eax, 0x84d3623d
jb 0x6fe998
pop esi
xor eax, 0x84d3623d
cmc
lds ebx, [esi + 0x6bcad5dd]
xor al, 0x7c
mov esi, 0xb9d2c2c1
and ch, byte [edx]
movsd dword es:[edi], dword [esi]
adc al, 0xc3
xchg edx, eax
mov dl, 0x19
loop 0x8190a8
std
pop esp
push ebx
mov eax, 0x9b048e9f
mov dword [0x2938d0c2], eax
sub eax, 0x94475148
ror byte [ecx + 0x4c], cl
mov dword [ebp + 0x19], esp
int 0x1c
or eax, 0x9edad7af
push esi
retf 0xe2c2
mov edx, 0x7c363f15
mov esi, 0x4b14fab4
mov edx, dword [esp + esi - 0x4b14faa8]
mov dword [esp + 0xc], 0xc21551c
mov esi, dword [esp + esi - 0x4b14fab0]
jl 0x8190a9

Function at 0xb1ec02
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
je 0x6f04dd
mov esi, dword [ebp + 0xc]
test edi, edi
cmp esi, edx
test esi, esi
jmp 0xb16162
je 0x6f04dd
mov eax, 0x5a4d
cmp word [edx], ax
jmp 0x6f04d7
push ebp
sal edx, cl
cdq
movzx edx, di
mov ebp, esp
shrd dx, sp, 4
mov edx, dword [ebp + 8]
test cx, 0xae84
clc
lea esp, [esp - 0x114]
push esi
test edx, edx
jmp 0x709c2f
Function at 0x100017c1
Capabilities:
Link many functions at runtime

Disassembly:
push ebx
push edi
push 0x14
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov edi, eax
pop ecx
test edi, edi
je 0x1000185c
push str.jvm.dll
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
mov ebx, eax
test ebx, ebx
jne 0x100017f3
push edi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
pop ecx
xor eax, eax
jmp 0x1000185e
push esi
mov esi, dword [sym.imp.kernel32.dll_GetProcAddress]
push str.JVM_DTraceGetVersion
push ebx
call esi
push str.JVM_DTraceIsSupported
push ebx
mov dword [edi], eax
call esi
push str.JVM_DTraceActivate
push ebx
mov dword [edi + 4], eax
call esi
push str.JVM_DTraceDispose
push ebx
mov dword [edi + 8], eax
call esi
push str.JVM_DTraceIsProbeEnabled
push ebx
mov dword [edi + 0xc], eax
call esi
push ebx
mov dword [edi + 0x10], eax
call dword [sym.imp.kernel32.dll_FreeLibrary]
xor esi, esi
cmp dword [edi], esi
je 0x10001851
cmp dword [edi + 4], esi
je 0x10001851
cmp dword [edi + 8], esi
je 0x10001851
cmp dword [edi + 0xc], esi
je 0x10001851
cmp dword [edi + 0x10], esi
jne 0x1000185b
push edi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
pop ecx
mov edi, esi
pop esi
mov eax, edi
pop edi
pop ebx
ret

Function at 0x100022cf
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
pushal
call 0x100022de
pop dword [ebp - 0x1c]
mov eax, 0x110384
add eax, 0xfef1f5a
sub dword [ebp - 0x1c], eax
mov dword [ebp - 0x2c], 0x62006c39
sub dword [ebp - 0x2c], 0x13ae26ee
mov dword [ebp - 0x28], 0xe8072069
add dword [ebp - 0x28], 0x4a2c2bdc
mov dword [ebp - 0x24], 0xe9144cf8
sub dword [ebp - 0x24], 0x9cc808ca
mov dword [ebp - 0x20], 0xb5029940
add dword [ebp - 0x20], 0x4afd66c0
lea eax, [ebp - 0x2c]
push eax
mov eax, 0x34b006cb
add eax, 0xdb502939
add eax, dword [ebp - 0x1c]
call dword [eax]
mov dword [ebp - 0x2c], 0x41360da4
add dword [ebp - 0x2c], 0x333c5bb2
mov dword [ebp - 0x28], 0x399fef1e
sub dword [ebp - 0x28], 0xf8338da9
mov dword [ebp - 0x24], 0xf99c6461
sub dword [ebp - 0x24], 0x962cf7f5
mov dword [ebp - 0x20], 0x54fced9a
add dword [ebp - 0x20], 0xab031266
lea ebx, [ebp - 0x2c]
push ebx
push eax
mov eax, 0x6045e929
sub eax, 0x5045b921
add eax, dword [ebp - 0x1c]
call dword [eax]
push 0x40
push 0x1000
push 0x34176
push 0
call eax
mov ecx, 0x6f409b3f
add ecx, 0x90bfa32c
mov esi, eax
mov edi, 0x10006200
add edi, dword [ebp - 0x1c]
mov ebx, 0x735c7cae
add dword [ebp - 0x18], 0x6e9cc1d3
mov edx, dword [edi]
xor dword [ebp - 0x18], 0xcee771ba
xor edx, ebx
xor dword [ebp - 4], 0xb015962b
mov dword [esi], edx
sub dword [ebp - 4], ecx
add esi, 0x60b88809
add esi, 0x9f4777fb
add edi, 0x6380048f
add edi, 0x9c7ffb75
loop 0x100023f4
add eax, 0xb2eb38c3
add eax, 0x4d15b3bc
mov ebx, eax
add eax, 0x8c6594ce
add eax, 0x739a6b37
mov ecx, 0x9529e3b4
add ecx, 0x7ad61c4c
add ecx, dword [ebp - 0x1c]
call ebx
leave
ret
Function at 0x40f340
Capabilities:
Log keystrokes

Disassembly:
push ebx
xor ebx, ebx
push edi
mov edi, dword [sym.imp.USER32.dll_MapVirtualKeyW]
mov dword [esi], 5
mov dword [esi + 4], 5
mov word [esi + 8], 1
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov word [esi + 0x18], bx
push ebx
mov dword [esi + 0x1a], ebx
mov word [esi + 0x1e], bx
push 0x5b
mov dword [esi + 0xc], 4
call edi
push ebx
push 0x10
mov byte [esi + 0x29], al
call edi
push ebx
push 0xa0
mov byte [esi + 0x26], al
call edi
push ebx
push 0xa1
mov byte [esi + 0x27], al
call edi
push ebx
push 0x11
mov byte [esi + 0x28], al
call edi
push ebx
push 0x12
mov byte [esi + 0x24], al
call edi
pop edi
mov byte [esi + 0x25], al
pop ebx
ret

Function at 0x40f4e0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x10020
call fcn.00426630
xor eax, eax
nop
mov cl, byte [eax + 0x4a3248]
mov dl, byte [eax + str._0ySF___CHGCQ0]
mov byte [ebp + eax - 0x20], cl
mov byte [ebp + eax - 0x18], dl
inc eax
cmp eax, 8
jl 0x40f4f0
lea eax, [ebp - 8]
push str._l7
push eax
call fcn.00413870
push 4
lea ecx, [ebp - 8]
push ecx
lea edx, [ebp - 0x10]
push edx
call fcn.004125e0
add esp, 0x14
push ebx
push esi
mov dword [ebp - 0xc], 0
push edi
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
push ecx
push 0x10000
lea edx, [ebp - 0x10020]
push 1
push edx
call fcn.0041527b
add esp, 0x10
cmp eax, 0x18
jl 0x40f5b1
mov edi, eax
lea esi, [edi - 0x14]
test esi, esi
jle 0x40f580
xor edx, edx
xor ecx, ecx
mov bl, byte [ebp + ecx - 0x20]
lea eax, [ecx + edx]
cmp bl, byte [ebp + eax - 0x10020]
je 0x40f59e
cmp ecx, 0x14
je 0x42a0f9
inc edx
cmp edx, esi
jl 0x40f560
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
lea edx, [ecx + edi - 0x14]
mov ecx, dword [eax]
push 1
push 0xffffffffffffffec
push ecx
mov dword [ebp - 0xc], edx
call fcn.00415641
add esp, 0xc
jmp 0x40f534
mov bl, byte [ebp + ecx - 0x1f]
lea eax, [ecx + edx]
cmp bl, byte [ebp + eax - 0x1001f]
je 0x40f5bf
inc ecx
jmp 0x40f572
mov eax, 3
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov bl, byte [ebp + ecx - 0x1e]
lea eax, [ecx + edx]
cmp bl, byte [ebp + eax - 0x1001e]
je 0x40f5d4
add ecx, 2
jmp 0x40f572
mov bl, byte [ebp + ecx - 0x1d]
lea eax, [ecx + edx]
cmp bl, byte [ebp + eax - 0x1001d]
jne 0x42a0f1
mov bl, byte [ebp + ecx - 0x1c]
lea eax, [ecx + edx]
cmp bl, byte [ebp + eax - 0x1001c]
je 0x42a0e0
add ecx, 4
jmp 0x40f572
add ecx, 5
cmp ecx, 0x14
jl 0x40f562
jmp 0x40f572
add ecx, 3
jmp 0x40f572
mov eax, dword [ebp - 0xc]
mov esi, dword [ebp + 8]
lea ecx, [eax + edx + 0x14]
mov edx, dword [esi]
push 0
push ecx
push edx
call fcn.00415641
mov eax, dword [esi]
push eax
push 4
lea ecx, [ebp - 8]
push 1
push ecx
call fcn.0041527b
lea edx, [ebp - 8]
push str.AUCN
push edx
mov byte [ebp - 4], 0
call fcn.004152a0
add esp, 0x24
neg eax
sbb eax, eax
and eax, 4
jmp 0x40f5b6
Function at 0x832ae1
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushal
mov dword [esp + 0x10], ecx
btc eax, esi
jp 0x832ac9
jnp 0x832ab3
jne 0x832a96
jge 0x832aaf
test dword [esi + 0x7c], reloc.KERNEL32.dll_SetEndOfFile
call 0x125bec18
salc
inc ecx
jmp 0x832a9b
popal
rcr eax, 0x11
mov eax, ebp
call fcn.00832b00
fiadd dword [edi - 0x29]
mov dl, 0x41
mov bh, byte [edx + 0x55]
les esi, [edi + 0x5e]
popal
rcr eax, 0x11
mov eax, ebp
call fcn.00832b4e
add eax, 0xe1a68318
jb 0x832ab1
jae 0x832a9b

Function at 0x832c4e
Capabilities:
Execute anti-debugging instructions

Disassembly:
push dword [esp + 3]
jbe 0x832cb2
lea esp, [esp + 1]
lea esp, [esp + 3]
jmp 0x832c77
push eax
push ecx
push edx
push ebp
jmp 0x832c38
mov dword [esp], ebx
lea esp, [esp + 1]
lea esp, [esp + 3]
jmp 0x832c8d

Function at 0x832c95
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0xf0821dd4
jmp 0x832d2e
jmp 0x832cbc
mov dword [esp], ecx
push word [esp]
jmp 0x832ce5
push word [esp + 1]
jne 0x832c97
mov dword [esp], ecx
push word [esp]
jmp 0x832d4f
mov dword [esp + 0x24], esi
push cx
lea esp, [esp + 1]
push ax
jmp 0x832cf7
lea esp, [esp + 3]
mov dword [esp + 0x20], edi
lea esp, [esp + 0x20]
jmp 0x832d28
pushfd
jmp 0x832929
rdtsc
bsf ebp, ebp
jmp 0x832e15
mov ebp, dword [esp]
mov dh, 0x60
call fcn.00832d71
aad 0x58
into
test eax, 0x2435eb58
push edi
mov esi, 0x74892889
and al, 0x24
mov dword [esp + 0x24], esi
push cx
lea esp, [esp + 1]
jmp 0x832cef
mov edi, dword [esp + 0x2c]
jmp 0x832d92
cmc
jno 0x832df3
setle ah
bswap ebx
jmp 0x832dfe
sub esp, 0xc0
jmp 0x832f41
setle ah
bswap ebx
jmp 0x832dfe
lea esi, [esp]
mov bp, ax
rdtsc
rdtsc
jmp 0x832d9c
jae 0x832d39
mov ebp, dword [esp]
mov dh, 0x60
jmp 0x832d88
call fcn.00832e25
mov ebp, esp
mov ax, di
rdtsc
neg cl
jno 0x832edc
xchg al, dl
jmp fcn.00832e3d

Function at 0x835317
Capabilities:
Execute anti-debugging instructions

Disassembly:
cmc
bsf dx, bp
jmp fcn.0083533f
pop eax
not dl
bts cx, cx
jne 0x835301
je 0x835355
ror dword [edx + eax*8 - 0x5b], cl
push esp
ljmp 0x1bdb
cmc
bsf dx, bp
jmp fcn.0083533f

Function at 0x835427
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov ax, di
rdtsc
pop word [esp]
lea esp, [esp + 2]
jmp 0x83543f
jmp 0x835411
xchg edx, eax
sub esp, 0x11
clc
lea esp, [esp + 1]
jmp 0x83549a
rol esi, 0
lea ecx, [edx + ebx]
not eax
xchg dh, al
inc dl
jmp 0x835451
jg 0x835429
xchg edx, eax
sub esp, 0x11
jmp 0x83545e
clc
lea esp, [esp + 1]
jmp 0x83549a
add esi, dword [edi]
lea edx, [ebp + ebp]
rcr ax, cl
jl 0x835484
jge 0x8354a8
sub dword [eax + reloc.KERNEL32.dll_SetEndOfFile], esp
pop ebp
lodsb al, byte [esi]
mov edi, 0xca0f3186
rol esi, 0
not dh
xchg dx, ax
mov cl, 0xde
mov ecx, dword [esp]
jmp 0x835465
not dx
mov dl, cl
jmp fcn.008354e0
Function at 0x835647
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dl, al
mov cx, 0x3c64
mov cx, word [esp]
sub esp, 0xa
jmp 0x8355b6
mov ch, byte [esp]
mov cx, ax
lea esp, [esp + 2]
jmp 0x83555e
clc
pop word [esp + 2]
mov cx, 0xbce3
jmp 0x835560
sub esp, 2
mov ch, byte [esp]
mov cx, ax
lea esp, [esp + 2]
jmp 0x835516
lea esp, [esp + 8]
inc dl
xchg ch, cl
setne ch
sub esp, 0x1d
jmp 0x83557c
mov cx, 0xbce3
jmp 0x835560
jp 0x835592
mov ecx, 0x3be6076c
neg ch
jmp 0x8355c0
mov ecx, 0x3be6076c
neg ch
bts ecx, esp
lea esp, [esp + 1]
lea esp, [esp + 0x1c]
sub dl, 0xc5
jmp 0x8355c9
jp 0x835538
clc
pop word [esp + 2]
jmp 0x835576
bts ecx, esp
lea esp, [esp + 1]
jmp 0x8355a0
sbb cl, bl
jb 0x835609
mov cx, sp
cmp ch, dh
bsr cx, sp
mov ch, byte [esp]
jmp 0x835626
sub al, bl
inc ecx
jo 0x835551
sub esp, 2
jmp 0x83552c
bsr cx, sp
mov ch, byte [esp]
jmp 0x835626
mov cx, sp
cmp ch, dh
jmp 0x8355f3
setb ch
mov cx, word [esp]
mov cl, byte [esp]
mov ecx, 0x3f8d90cd
jmp 0x83564d
xor dl, 0xe5
mov cl, 0x29
dec cx
jb 0x835610
jae 0x835663
mov ecx, 0x3f8d90cd
jmp 0x83564d
lea ecx, [esp + 0x5e]
jmp 0x8355e2
rol dl, 0
inc cx
jg 0x83566f
mov ecx, ebp
setl ch
jmp 0x83568f
setb ch
mov cx, word [esp]
mov cl, byte [esp]
jmp 0x835631
mov ecx, ebp
jmp 0x8356a5
setl ch
lea ecx, [ebx*4]
lea ecx, [ebp*4]
jmp 0x8366a2
mov ecx, edi

Function at 0x835ab2
Capabilities:
Encode data using xor
Execute anti-debugging instructions

Disassembly:
lea ecx, [edx - 0x48]
call 0x835863
stc
mov ecx, esp
ror al, 0
jmp 0x835b01
mov ecx, 0x8bea69e6
mov ecx, esi
not ecx
sete ch
dec dx
jmp 0x835b22
pop ss
xchg edx, esp
adc dword [ebp + reloc.KERNEL32.dll_SetEndOfFile], ebp
not ecx
sete ch
dec dx
jmp 0x835b22
jno 0x835ac6
mov ecx, 0x8bea69e6
mov ecx, esi
jmp 0x835ae8
add byte [eax], al
adc al, 0x90
push es
popal
nop
mov cl, byte cs:[0xd617e49d]
sbb al, 4
jno 0x835ad7
add al, 0x71
mov dl, 0x97
xchg edi, eax
bswap edx
call fcn.00835b0c
arpl word [0x47f5], ax
jg 0x835b29
invalid
push 0xd
cld
cmp byte [ebx - 0x1f], ch
jno 0x835b4d
jecxz 0x835b9d
mov al, byte [0x8ae5e181]
jnp 0x835b13
movsd dword es:[edi], dword [esi]
lea esi, [esi + 0x61]
lea ecx, [ecx + ebp]
xchg ecx, edx
btc edx, ecx
cmc
xchg dword [esp], esi
jmp 0x835bca
neg dx
setle cl
push dword [esp]
ret 4

Function at 0x83b6d6
Capabilities:
Execute anti-debugging instructions

Disassembly:
call fcn.0083ade4
popfd
ret
rdtsc
mov ebp, dword [esp + 4]
rdtsc
mov dx, bx
mov dh, byte [esp]
jmp 0x83b71f
mov dl, byte [esp]
mov dx, ax
mov eax, dword [esp + 8]
setl dl
mov dx, word [esp]
jmp 0x83b777
pushal
jmp 0x83addf
mov edx, dword [esp + 0xc]
lea esp, [esp + 0x10]
cmp dword [esp + 4], 0
jne 0x83b62f
je 0x83b759
Function at 0x83f2f3
Capabilities:
Check for trap flag exception

Disassembly:
push ebx
jmp 0x825992
pushfd
or dword [esp], reloc.KERNEL32.dll_SetEndOfFile
popfd
cpuid
nop
jmp 0x8259a9
pop ebx
ret
lea eax, reloc.KERNEL32.dll_SetEndOfFile
setns ah
mov esi, dword [esp]
setge al
jmp 0x83f30b
xchg byte [esp + 2], bl
xchg dword [esp], eax
lea ebx, [ebp*4]
lea eax, [ebx + edi]
mov byte [esp + 2], ch
mov ebx, dword [esp + 4]
jmp 0x83f2b2
jmp 0x83f2c8
mov ax, 0x77dd
mov ax, word [esp]
mov eax, dword [esp + 0xc]
lea esp, [esp + 0x10]
jmp 0x825986
mov si, word [esp]
mov esi, dword [esp + 8]
mov ax, 0x5ea9
mov eax, 0x8524e14c
mov ax, word [esp]
lea eax, [ebp*4]
jmp 0x83f2f5

Function at 0x8458a3
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov ecx, eax
inc ebx
jmp 0x8449df
lea ebx, [ecx*4]
rol ebx, 0x15
lea ebx, [esi + ebp]
mov ebx, dword [esp]
sub esp, 0
jmp 0x84491c
mov ebx, ebp
stc
mov cx, 0x43ea
jmp 0x844b9d
adc bl, 0x47
bsr ebx, edx
call fcn.00844902
int 0x50
invalid
mov bl, byte [esp]
jmp 0x8448d1
xor ecx, 0x35a25de2
clc
jae 0x8448e7
mov bl, byte [esp]
adc bl, 0x47
bsr ebx, edx
jmp 0x8448d7
lea ebx, [esi + ebp]
mov ebx, dword [esp]
sub esp, 0
jmp 0x84491c
jb 0x8448ac
lea ebx, [ecx*4]
rol ebx, 0x15
jmp 0x84498b
mov ebx, ebp
stc
mov cx, 0x43ea
jmp 0x8448a3
neg ch
sub eax, edx
jbe 0x844b96
ja 0x8448c5
mov eax, 0x55a6c573
jmp 0x844d3a
xchg ebx, eax
lea ecx, [edx*4]
setle bh
mov edi, dword [esi]
mov al, 0x24
jmp 0x844d84
lea eax, [ecx*4]
lea ebx, [edx + edx]
jmp 0x844db6
mov al, 0xa0
mov ecx, ebx
mov cx, bp
add esi, 4
mov eax, 0xdf246334
jmp 0x844d6e
mov ax, 0xacee
mov ax, dx
push edx
clc
jb 0x844df8
mov ebx, eax
lea ecx, [edx + 0xd1]
cmc
jmp 0x844dfa
mov ebx, eax
lea ecx, [edx + 0xd1]
cmc
jmp 0x844dfa
jmp 0x844de2
push edi
not bx
sub esp, 0x1f
jmp 0x844f44
push dx
lea esp, [esp + 1]
jmp 0x844e93
bswap ebx
jmp 0x844d0c
mov dh, byte [esp]
jmp 0x844e74
sub esp, 7
mov al, 0xe9
lea esp, [esp + 3]
jmp 0x844e2c
add esp, 4
jmp 0x844e9d
bswap esi
sub esp, 7
mov al, 0xe9
lea esp, [esp + 3]
mov dh, byte [esp]
lea ecx, [ecx*4]
and dl, cl
js 0x844e4d
retf 0xce78
jns 0x844e4d
dec esp
jmp 0x844e7c
push esi
rcl ch, 4
jb 0x844e66
bswap esi
jmp 0x844e42
jl 0x844eb3
jge 0x844eb3
call 0x31891233
push esp
jge 0x844ea9
retf 0x2876
pop edi
mov bx, di
sbb si, 0x8be1
jo 0x844ed8
jno 0x844f04
mov si, 0xea0a
mov esi, dword [esp]
jmp 0x844eda
jmp 0x844f04
shl ax, 6
jl 0x844f21
rdtsc
mov bl, 0x7a
jmp 0x844f0b
lea esp, [esp + 4]
sub esp, 0xa
bsf ebx, esp
xchg dword [esp + 1], edx
jmp 0x844f27
add esp, 0x20
jb 0x844ec0
jae 0x844ec0
lea esp, [esp + 4]
sub esp, 0xa
bsf ebx, esp
jmp 0x844ef5
rdtsc
mov bl, 0x7a
jmp 0x844eeb
rdtsc
lea esp, [esp + 2]
add esp, 8
jno 0x845105
jo 0x845105
rcr byte [ebp - 0x33], 1
xchg esp, eax
mov al, byte [0x3f2c]
ja 0x844e07
push dx
lea esp, [esp + 1]
jmp 0x844e0d
pop ebx
jmp fcn.008352d9
jmp 0x844fbc
setae cl
lea ebx, [eax*4]
bsf ebx, esi
jbe 0x844e25
bswap ebx
neg ch
jmp 0x844d0e
mov eax, dword [edi]
mov ebx, 0xdccc8c5e
lea ebx, [ebx*4]
mov ch, 0x38
mov cl, 0x75
jmp 0x84517e
lea ebx, reloc.KERNEL32.dll_SetEndOfFile
jmp 0x845212
Function at 0x89f920
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ax
lea esp, [esp + 2]
lea esp, [esp + 4]
jmp 0x89f8c8

Function at 0xa0c035
Capabilities:
Access peb ldr_data

Disassembly:
push word [esp + 2]
lea esp, [esp + 2]
mov dword [esp + 0x20], edi
jmp 0xa0c00b
Function at 0x4e83b0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0xa4000]
push edi
jmp 0x4e83ca
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x4e83d1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4e83c0
mov eax, 1
add ebx, ebx
jne 0x4e83e3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x4e83f4
jne 0x4e8413
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4e8413
dec eax
add ebx, ebx
jne 0x4e8400
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x4e83d8
add ebx, ebx
jne 0x4e840f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x4e8465
xor ecx, ecx
sub eax, 3
jb 0x4e842b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x4e849a
sar eax, 1
mov ebp, eax
jmp 0x4e8436
add ebx, ebx
jne 0x4e8436
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4e8404
inc ecx
add ebx, ebx
jne 0x4e8444
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4e8404
add ebx, ebx
jne 0x4e8451
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x4e8446
jne 0x4e8462
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4e8446
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x4e8484
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x4e8476
jmp 0x4e83c6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x4e8484
add edi, ecx
jmp 0x4e83c6
pop esi
mov edi, esi
mov ecx, 0x469e
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x4e84a2
cmp byte [edi], 0xe
jne 0x4e84a2
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x4e84a7
lea edi, [esi + 0xe5000]
mov eax, dword [edi]
or eax, eax
je 0x4e851f
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xf9b0c]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xf9bfc]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x4e84d4
mov ecx, edi
jns 0x4e8503
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xf9c00]
or eax, eax
je 0x4e8519
mov dword [ebx], eax
add ebx, 4
jmp 0x4e84f1
call dword [esi + 0xf9c10]
mov ebp, dword [esi + 0xf9c04]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x237]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x4e8553
sub esp, 0xffffff80
jmp 0x457c88
Function at 0x401920
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x469238
mov eax, dword fs:[0]
push eax
sub esp, 0x78
mov eax, dword [0x484db8]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 1
lea eax, [ebp - 0x71]
push eax
push ecx
lea ecx, [ebp - 0x40]
call fcn.00402330
lea ecx, [ebp - 0x70]
mov dword [ebp - 4], 0
call fcn.004015f0
add eax, 4
cmp dword [eax + 0x14], 8
jb 0x401973
mov eax, dword [eax]
push 0
push 0x80
push 4
push 0
push 1
push 0xc0000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
mov eax, dword [ebp - 0x48]
lea edi, [ebp - 0x48]
mov eax, dword [eax + 4]
add edi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [edi], eax
push dword [ebp - 0x54]
call fcn.0043e335
mov edi, dword [sym.imp.OLEAUT32.dll_SysStringLen]
add esp, 4
push dword [ebp - 0x4c]
call edi
cmp dword [ebp - 0x58], 8
jb 0x4019c2
push dword [ebp - 0x6c]
call edi
xor eax, eax
mov word [ebp - 0x6c], ax
mov eax, dword [ebp - 0x70]
mov dword [ebp - 0x58], 7
mov dword [ebp - 0x5c], 0
mov eax, dword [eax + 4]
push dword [ebp + eax - 0x70]
call dword [sym.imp.KERNEL32.dll_SetLastError]
cmp byte [0x487875], 0
mov eax, dword [sym.imp.KERNEL32.dll_SetFilePointer]
jne 0x401a6d
push 0
push 0
push 0
push esi
mov dword [ebp - 0x78], 0
mov dword [ebp - 0x7c], 0
call eax
push 0
lea eax, [ebp - 0x7c]
push eax
push 2
lea eax, [ebp - 0x78]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x401a3b
cmp dword [ebp - 0x7c], 2
jne 0x401a3b
mov eax, 0xfeff
cmp word [ebp - 0x78], ax
sete al
mov byte [0x487875], al
jmp 0x401a40
mov al, byte [0x487875]
test al, al
jne 0x401a61
push 0
lea eax, [ebp - 0x84]
push eax
push 2
lea eax, [ebp - 0x80]
push eax
push esi
mov dword [ebp - 0x80], 0xfeff
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov byte [0x487875], 1
push 2
push 0
push 0
push esi
call eax
cmp dword [ebp - 0x28], 8
push 0
lea eax, [ebp - 0x84]
push eax
mov eax, dword [ebp - 0x2c]
lea ecx, [ebp - 0x3c]
cmovae ecx, dword [ebp - 0x3c]
add eax, eax
push eax
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test esi, esi
je 0x401aa8
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x401aa8
push esi
call eax
mov eax, dword [ebp - 0x18]
lea esi, [ebp - 0x18]
mov eax, dword [eax + 4]
add esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi], eax
push dword [ebp - 0x24]
call fcn.0043e335
add esp, 4
push dword [ebp - 0x1c]
call edi
cmp dword [ebp - 0x28], 8
jb 0x401ad6
push dword [ebp - 0x3c]
call edi
xor eax, eax
mov word [ebp - 0x3c], ax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x28], 7
mov dword [ebp - 0x2c], 0
mov eax, dword [eax + 4]
push dword [ebp + eax - 0x40]
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0043e056
mov esp, ebp
pop ebp
ret