joyce8/EMBER2024-capa huggingface dataset:
Function at 0x466e50
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2ec
mov eax, dword [0x4c63f4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x2ec], ebx
push edi
test ebx, ebx
je 0x467054
mov edi, dword [ebp + 0xc]
test edi, edi
je 0x467054
push esi
push 0x64
lea eax, [ebp - 0x68]
push 0
push eax
call fcn.00469f70
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea eax, [ebp - 0x2d8]
add esp, 0xc
push eax
push 8
push 0
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionNetworkCards
push 0x80000002
call esi
test eax, eax
jne 0x467029
xor edi, edi
mov dword [ebp - 0x2dc], 0x104
push edi
push edi
push edi
push edi
lea eax, [ebp - 0x2dc]
push eax
lea eax, [ebp - 0x1d0]
push eax
push edi
push dword [ebp - 0x2d8]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x467018
lea eax, [ebp - 0x2e0]
push eax
push 1
push 0
lea eax, [ebp - 0x1d0]
push eax
push dword [ebp - 0x2d8]
call esi
test eax, eax
jne 0x466fe2
lea eax, [ebp - 0x2e4]
mov dword [ebp - 0x2e8], 1
push eax
lea eax, [ebp - 0x2d4]
mov dword [ebp - 0x2e4], 0x104
push eax
lea eax, [ebp - 0x2e8]
push eax
push 0
push str.ServiceName
push dword [ebp - 0x2e0]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x466fda
push 0x64
push eax
lea eax, [ebp - 0xcc]
push eax
call fcn.00469f70
push 0x64
lea eax, [ebp - 0xcc]
push eax
lea eax, [ebp - 0x2d4]
push eax
call fcn.00467070
add esp, 0x18
test eax, eax
je 0x466fda
cmp byte [ebp - 0x68], 0
je 0x466f9c
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0xcc]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
jns 0x466fda
lea ecx, [ebp - 0x68]
mov edx, 0x64
lea esi, [ebp - 0xcc]
mov eax, ecx
sub esi, eax
nop
lea eax, [edx + 0x7fffff9a]
test eax, eax
je 0x466fc9
mov al, byte [esi + ecx]
test al, al
je 0x466fc9
mov byte [ecx], al
inc ecx
sub edx, 1
jne 0x466fb0
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea eax, [ecx - 1]
test edx, edx
cmovne eax, ecx
mov byte [eax], 0
push dword [ebp - 0x2e0]
call ebx
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x2dc]
mov dword [ebp - 0x2dc], 0x104
push eax
lea eax, [ebp - 0x1d0]
inc edi
push eax
push edi
push dword [ebp - 0x2d8]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
je 0x466ef0
push dword [ebp - 0x2d8]
call ebx
mov ebx, dword [ebp - 0x2ec]
mov edi, dword [ebp + 0xc]
cmp byte [ebp - 0x68], 0
pop esi
je 0x467054
lea eax, [ebp - 0x68]
push eax
push edi
push ebx
call fcn.00468040
xor ecx, ecx
test eax, eax
pop edi
setns cl
mov eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0045e17a
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
xor ecx, ebp
pop ebx
call fcn.0045e17a
mov esp, ebp
pop ebp
ret
Function at 0x467190
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50c
mov eax, dword [0x4c63f4]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
mov edi, dword [ebp + 8]
test edi, edi
je 0x46730f
cmp dword [ebp + 0xc], 0x20
jb 0x46730f
push 0x400
lea eax, [ebp - 0x504]
mov dword [ebp - 0x50c], 1
push 0
push eax
mov dword [ebp - 0x508], 0x400
call fcn.00469f70
add esp, 0xc
lea eax, [ebp - 0x508]
push eax
lea eax, [ebp - 0x504]
push eax
lea eax, [ebp - 0x50c]
push eax
push 0x4abefc
push str.SoftwareComMaster
push 0x80000002
call dword [sym.imp.SHLWAPI.dll_SHGetValueA]
test eax, eax
jne 0x46730f
lea ecx, [ebp - 0x504]
lea edx, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x467220
sub ecx, edx
cmp ecx, 0x40
jne 0x46730f
lea edx, [ecx + 0x40]
push esi
lea ecx, [ebp - 0x84]
lea esi, [ebp - 0x504]
mov eax, ecx
sub esi, eax
lea eax, [edx - 0x60]
test eax, eax
je 0x46725c
mov al, byte [esi + ecx]
test al, al
je 0x46725c
mov byte [ecx], al
inc ecx
sub edx, 1
jne 0x467246
test edx, edx
lea eax, [ecx - 1]
lea esi, [ebp - 0x4e4]
mov edx, 0x80
cmovne eax, ecx
lea ecx, [ebp - 0x104]
mov byte [eax], 0
mov eax, ecx
sub esi, eax
nop dword [eax]
lea eax, [edx + 0x7fffff7e]
test eax, eax
je 0x467299
mov al, byte [esi + ecx]
test al, al
je 0x467299
mov byte [ecx], al
inc ecx
sub edx, 1
jne 0x467280
test edx, edx
lea eax, [ecx - 1]
push 0x400
cmovne eax, ecx
push 0
mov byte [eax], 0
lea eax, [ebp - 0x504]
push eax
call fcn.00469f70
push 0x400
lea eax, [ebp - 0x504]
push eax
lea eax, [ebp - 0x84]
push eax
call fcn.00467320
add esp, 0x18
lea eax, [ebp - 0x104]
push eax
lea eax, [ebp - 0x504]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
pop esi
test eax, eax
jne 0x46730f
lea eax, [ebp - 0x84]
push eax
push dword [ebp + 0xc]
push edi
call fcn.00468040
neg eax
pop edi
sbb eax, eax
inc eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0045e17a
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
pop edi
call fcn.0045e17a
mov esp, ebp
pop ebp
ret
Function at 0x467be0
Capabilities:
Get storage device properties

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2c10
call fcn.0045e190
mov eax, dword [0x4c63f4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x2c10], eax
test eax, eax
je 0x467d4d
cmp dword [ebp + 0xc], 0
je 0x467d4d
push ebx
push esi
xor ebx, ebx
xor esi, esi
push edi
nop dword [eax]
push esi
push str..PhysicalDrive_d
lea eax, [ebp - 0x104]
push 0x100
push eax
call fcn.00463dd0
add esp, 0x10
lea eax, [ebp - 0x104]
push 0
push 0
push 3
push 0
push 3
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x467d30
push 0x2710
xorps xmm0, xmm0
mov dword [ebp - 0x2c0c], 0
lea eax, [ebp - 0x2bfc]
movq qword [ebp - 0x2c08], xmm0
push 0
push eax
mov dword [ebp - 0x2c00], 0
mov dword [ebp - 0x2c08], 0
mov dword [ebp - 0x2c04], 0
call fcn.00469f70
add esp, 0xc
lea eax, [ebp - 0x2c0c]
push 0
push eax
push 0x2710
lea eax, [ebp - 0x2bfc]
push eax
push 0xc
lea eax, [ebp - 0x2c08]
push eax
push 0x2d1400
push edi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x467d25
push 0x3e8
lea eax, [ebp - 0x4ec]
push 0
push eax
call fcn.00469f70
lea eax, [ebp - 0x4ec]
push eax
push 1
push dword [ebp - 0x2be4]
lea eax, [ebp - 0x2bfc]
push eax
call fcn.00468d40
add esp, 0x1c
lea eax, [ebp - 0x4ec]
push eax
push dword [ebp + 0xc]
push dword [ebp - 0x2c10]
call fcn.00468040
test eax, eax
mov eax, 1
cmove ebx, eax
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
jne 0x467d3a
inc esi
cmp esi, 0x10
jl 0x467c20
pop edi
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0045e17a
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
call fcn.0045e17a
mov esp, ebp
pop ebp
ret
Function at 0x467d60
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x4c63f4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
test ebx, ebx
je 0x467e48
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.00469f70
add esp, 0xc
lea eax, [ebp - 0x20c]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov edx, eax
test edx, edx
je 0x467e48
mov ecx, ebx
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x467db7
sub ecx, esi
mov eax, 0x103
sar ecx, 1
sub eax, ecx
cmp edx, eax
jae 0x467e48
push edi
lea edi, [ebp - 0x20c]
add edi, 0xfffffffe
nop dword [eax + eax]
mov ax, word [edi + 2]
lea edi, [edi + 2]
test ax, ax
jne 0x467de0
mov eax, dword [0x4ab9bc]
mov esi, ebx
mov dword [edi], eax
mov ax, word [ebx]
add ebx, 2
test ax, ax
jne 0x467df5
lea edi, [ebp - 0x20c]
sub ebx, esi
add edi, 0xfffffffe
nop dword [eax + eax]
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x467e10
mov ecx, ebx
lea eax, [ebp - 0x20c]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0045e17a
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
pop esi
xor ecx, ebp
pop ebx
call fcn.0045e17a
mov esp, ebp
pop ebp
ret
Function at 0x467e60
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x290
mov eax, dword [0x4c63f4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x84]
push edi
push 0x80
push 0
push eax
call fcn.00469f70
push 0x80
lea eax, [ebp - 0x84]
push eax
push esi
call fcn.00467320
lea ecx, [ebp - 0x188]
mov edi, esi
mov eax, ecx
add esp, 0x18
mov edx, 0x104
sub edi, eax
lea eax, [edx + 0x7ffffefa]
test eax, eax
je 0x467eca
mov al, byte [edi + ecx]
test al, al
je 0x467eca
mov byte [ecx], al
inc ecx
sub edx, 1
jne 0x467eb1
lea eax, [ecx - 1]
test edx, edx
cmovne eax, ecx
mov ecx, 0x104
mov byte [eax], 0
lea eax, [ebp - 0x188]
cmp byte [eax], 0
je 0x467eeb
inc eax
sub ecx, 1
jne 0x467ee0
mov edx, 0x104
mov edi, ecx
mov eax, edx
sub eax, ecx
neg edi
sbb edi, edi
and edi, eax
test ecx, ecx
je 0x467f40
lea ecx, [ebp - 0x188]
lea ecx, [ecx + edi]
sub edx, edi
je 0x467f35
lea edi, [ebp - 0x84]
mov eax, 0x7fffffff
sub edi, ecx
push ebx
nop dword [eax + eax]
test eax, eax
je 0x467f34
mov bl, byte [edi + ecx]
test bl, bl
je 0x467f34
mov byte [ecx], bl
dec eax
inc ecx
sub edx, 1
jne 0x467f20
pop ebx
test edx, edx
lea eax, [ecx - 1]
cmovne eax, ecx
mov byte [eax], 0
push 0x100
lea eax, [ebp - 0x288]
mov dword [ebp - 0x290], 1
push 0
push eax
call fcn.00469f70
add esp, 0xc
mov dword [ebp - 0x28c], 0x100
lea eax, [ebp - 0x28c]
push eax
lea eax, [ebp - 0x288]
push eax
lea eax, [ebp - 0x290]
push eax
push 0x4abefc
push str.SoftwareComMaster
push 0x80000002
call dword [sym.imp.SHLWAPI.dll_SHGetValueA]
mov edi, dword [sym.imp.SHLWAPI.dll_SHSetValueA]
test eax, eax
jne 0x467ffa
lea eax, [ebp - 0x288]
mov cl, byte [eax]
cmp cl, byte [esi]
jne 0x467fc4
test cl, cl
je 0x467fc0
mov cl, byte [eax + 1]
cmp cl, byte [esi + 1]
jne 0x467fc4
add eax, 2
add esi, 2
test cl, cl
jne 0x467fa4
xor eax, eax
jmp 0x467fc9
sbb eax, eax
or eax, 1
test eax, eax
je 0x467ffa
lea ecx, [ebp - 0x288]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x467fd6
sub ecx, edx
lea eax, [ebp - 0x288]
push ecx
push eax
push 1
push str.mid_old
push str.SoftwareComMaster
push 0x80000002
call edi
lea ecx, [ebp - 0x188]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x468003
sub ecx, edx
lea eax, [ebp - 0x188]
push ecx
push eax
push 1
push 0x4abefc
push str.SoftwareComMaster
push 0x80000002
call edi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0045e17a
mov esp, ebp
pop ebp
ret

Function at 0x48e88d
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0048e50a

Function at 0x4931cd
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00493043
Function at 0x405a3d
Capabilities:
Create process on windows

Disassembly:
mov eax, dword [esp + 4]
push eax
and dword [eax + 0x24], 0
mov dword [eax], 0x3c
call dword [sym.imp.shell32.dll_ShellExecuteExW]
ret 4

Function at 0x405b23
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
pushal
call 0x405b32
pop dword [ebp - 0x2c]
mov eax, 0x8515dd74
add eax, 0x7b2a7dbe
sub dword [ebp - 0x2c], eax
mov dword [ebp - 0x3c], 0x601c14cc
sub dword [ebp - 0x3c], 0x11c9cf81
mov dword [ebp - 0x38], 0xa3bbede1
sub dword [ebp - 0x38], 0x7188a19c
mov dword [ebp - 0x34], 0x1a140a6c
sub dword [ebp - 0x34], 0xcdc7c63e
mov dword [ebp - 0x30], 0x7c69fa50
sub dword [ebp - 0x30], 0x7c69fa50
lea eax, [ebp - 0x3c]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x2c]
call dword [eax]
mov dword [ebp - 0x3c], 0xd815b9e4
add dword [ebp - 0x3c], 0x9c5caf72
mov dword [ebp - 0x38], 0x9f412b15
add dword [ebp - 0x38], 0xa22b3660
mov dword [ebp - 0x34], 0xf6445416
add dword [ebp - 0x34], 0x6d2b1856
mov dword [ebp - 0x30], 0xa7e6df38
add dword [ebp - 0x30], 0x581920c8
lea ebx, [ebp - 0x3c]
push ebx
push eax
mov eax, 0x598008b
add eax, 0xfaa87ff1
add eax, dword [ebp - 0x2c]
call dword [eax]
push 0x40
push 0x1000
push 0x37c74
push 0
call eax
mov ecx, 0xfb14e870
sub ecx, 0xfb149d5d
xor esi, esi
add esi, eax
mov edx, 0x2a119f04
sub edx, 0x29cc8b04
add edx, dword [ebp - 0x2c]
mov edi, 0x94025d0d
sub edi, 0xfedc48db
xor dword [ebp - 0x28], 0x7cec1404
mov ebx, dword [edx]
add dword [ebp - 0x24], ecx
xor ebx, edi
add dword [ebp - 0x24], edi
mov dword [esi], ebx
sub dword [ebp - 0x14], 0x76ec1cbc
add esi, 0x816698c5
add esi, 0x7e99673f
add edx, 4
loop 0x405c51
add eax, 0xf0fc5089
add eax, 0xf04ce96
xor ebx, ebx
add ebx, eax
add eax, 0x4a92535e
sub eax, 0x4a925359
mov ecx, 0x194aec7a
add ecx, 0xe6f51386
add ecx, dword [ebp - 0x2c]
call ebx
leave
ret

Function at 0x405dee
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push esi
push edi
push dword [esp + 0xc]
mov esi, 0x42fa70
push esi
call fcn.00406411
push esi
call fcn.00405d91
mov edi, eax
test edi, edi
jne 0x405e0f
xor eax, eax
jmp 0x405e67
push edi
call fcn.004066c0
test byte [0x434f1c], 0x80
je 0x405e2c
mov ax, word [edi]
test ax, ax
je 0x405e0b
cmp ax, 0x5c
je 0x405e0b
sub edi, esi
sar edi, 1
jmp 0x405e46
call fcn.0040676f
test eax, eax
je 0x405e40
test byte [eax], 0x10
je 0x405e0b
push esi
call fcn.00405d32
push esi
call sub.kernel32.dll_lstrlenW
cmp eax, edi
push esi
jg 0x405e32
call fcn.00405ce6
push esi
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov eax, ecx
pop edi
pop esi
ret 4

Function at 0x405ee2
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push esi
push dword [esp + 8]
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
mov esi, eax
cmp esi, 0xffffffff
je 0x405f01
and al, 0xfe
push eax
push dword [esp + 0xc]
call dword [sym.imp.kernel32.dll_SetFileAttributesW]
mov eax, esi
pop esi
ret 4
Function at 0x25802400
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
pushal
call 0x2580240f
pop dword [ebp - 0x3c]
mov eax, 0xa1b1b10
add eax, 0x1b6508ff
sub dword [ebp - 0x3c], eax
mov dword [ebp - 0x4c], 0x7dfe42a
add dword [ebp - 0x4c], 0x46726121
mov dword [ebp - 0x48], 0x2c3f4376
add dword [ebp - 0x48], 0x5f408cf
mov dword [ebp - 0x44], 0x1fb00d41
add dword [ebp - 0x44], 0x2c9c36ed
mov dword [ebp - 0x40], 0x3e6e2890
add dword [ebp - 0x40], 0xc191d770
lea eax, [ebp - 0x4c]
push eax
mov eax, 0x9c532c39
sub eax, 0x76d15bf5
add eax, dword [ebp - 0x3c]
call dword [eax]
mov dword [ebp - 0x4c], 0xeb08fa8a
sub dword [ebp - 0x4c], 0x76969134
mov dword [ebp - 0x48], 0xfd75014c
add dword [ebp - 0x48], 0x43f76029
mov dword [ebp - 0x44], 0xeae1d65f
add dword [ebp - 0x44], 0x788d960d
mov dword [ebp - 0x40], 0x945c6533
sub dword [ebp - 0x40], 0x945c6533
lea ebx, [ebp - 0x4c]
push ebx
push eax
mov eax, 0x134a3a19
add eax, 0x12379667
add eax, dword [ebp - 0x3c]
call dword [eax]
push 0x40
push 0x1000
push 0x3be6f
push 0
call eax
mov ecx, 0x29761007
sub ecx, 0x2975cbc5
xor edx, edx
add edx, eax
mov ebx, 0x80b2d9cb
sub ebx, 0x5b3043cb
add ebx, dword [ebp - 0x3c]
mov esi, 0x353aa57f
sub esi, 0x4696f33f
add dword [ebp - 8], 0x87bc3a05
mov edi, dword [ebx]
mov dword [ebp - 0x30], 0x80787ee8
xor edi, esi
mov dword [edx], edi
mov dword [ebp - 4], 0xb91c8ec1
add edx, 0x78d4c789
sub edx, 0x78d4c785
add ebx, 0x1a8f16ea
sub ebx, 0x1a8f16e6
loop 0x25802533
add eax, 0x103db
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x25800000
add ecx, dword [ebp - 0x3c]
call ebx
leave
ret
Function at 0x42ee70
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x22000]
push edi
jmp 0x42ee8a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x42ee91
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x42ee80
mov eax, 1
add ebx, ebx
jne 0x42eea3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x42ee98
jne 0x42eeb4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x42ee98
xor ecx, ecx
sub eax, 3
jb 0x42eec8
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x42ef3a
mov ebp, eax
add ebx, ebx
jne 0x42eed3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x42eee0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x42ef04
inc ecx
add ebx, ebx
jne 0x42eef0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x42eee5
jne 0x42ef01
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x42eee5
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x42ef24
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x42ef15
jmp 0x42ee86
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x42ef24
add edi, ecx
jmp 0x42ee86
pop esi
mov edi, esi
mov ecx, 0x91a
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x42ef42
cmp byte [edi], 9
jne 0x42ef42
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x42ef47
lea edi, [esi + 0x2c000]
mov eax, dword [edi]
or eax, eax
je 0x42efbf
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x3fe70]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x3ff50]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x42ef74
mov ecx, edi
jns 0x42efa3
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x3ff58]
or eax, eax
je 0x42efb9
mov dword [ebx], eax
add ebx, 4
jmp 0x42ef91
call dword [esi + 0x3ff54]
mov ebp, dword [esi + 0x3ff5c]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x17f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x42eff3
sub esp, 0xffffff80
jmp 0x41382f
Function at 0x1002aadf
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
pushal
call 0x1002aaee
pop dword [ebp - 0x34]
mov eax, 0x11574a69
add eax, 0xfeab6085
sub dword [ebp - 0x34], eax
mov dword [ebp - 0x44], 0xfd96d82
sub dword [ebp - 0x44], 0xc1872837
mov dword [ebp - 0x40], 0xca062ce
add dword [ebp - 0x40], 0x2592e977
mov dword [ebp - 0x3c], 0x2401c4eb
sub dword [ebp - 0x3c], 0xd7b580bd
mov dword [ebp - 0x38], 0xa2707b41
sub dword [ebp - 0x38], 0xa2707b41
lea eax, [ebp - 0x44]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x34]
call dword [eax]
mov dword [ebp - 0x44], 0x81a3a97e
add dword [ebp - 0x44], 0xf2cebfd8
mov dword [ebp - 0x40], 0x18b6e6fe
sub dword [ebp - 0x40], 0xd74a8589
mov dword [ebp - 0x3c], 0x503f96d6
sub dword [ebp - 0x3c], 0xecd02a6a
mov dword [ebp - 0x38], 0x46ade542
sub dword [ebp - 0x38], 0x46ade542
lea ebx, [ebp - 0x44]
push ebx
push eax
mov eax, 0xe7c4852f
add eax, 0x283e3af9
add eax, dword [ebp - 0x34]
call dword [eax]
push 0x40
push 0x1000
push 0x37a88
push 0
call eax
mov ecx, 0xafaebb27
add ecx, 0x5051919c
xor edi, edi
add edi, eax
mov ebx, 0x10039600
add ebx, dword [ebp - 0x34]
mov esi, 0xf3d1d924
add esi, 0x94b90218
xor dword [ebp - 0x1c], eax
mov edx, dword [ebx]
xor dword [ebp - 0x20], 0x6d480a1f
add edx, esi
add dword [ebp - 0x2c], edx
mov dword [edi], edx
add edi, 0x6d365a3
add edi, 0xf92c9a61
add ebx, 0x8ae98e4d
add ebx, 0x751671b7
loop 0x1002ac07
add eax, 0x125df
xor ebx, ebx
add ebx, eax
add eax, 0x73d5e5e2
sub eax, 0x73d5e5dd
mov ecx, 0x10000000
add ecx, dword [ebp - 0x34]
call ebx
leave
ret
Function at 0x418cc0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x12000]
push edi
or ebp, 0xffffffff
jmp 0x418ce2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x418ce9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x418cd8
mov eax, 1
add ebx, ebx
jne 0x418cfb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x418cf0
jne 0x418d0c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x418cf0
xor ecx, ecx
sub eax, 3
jb 0x418d20
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x418d92
mov ebp, eax
add ebx, ebx
jne 0x418d2b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x418d38
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x418d5c
inc ecx
add ebx, ebx
jne 0x418d48
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x418d3d
jne 0x418d59
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x418d3d
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x418d7c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x418d6d
jmp 0x418cde
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x418d7c
add edi, ecx
jmp 0x418cde
pop esi
mov edi, esi
mov ecx, 0x455
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x418d9a
cmp byte [edi], 0
jne 0x418d9a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x418d9f
lea edi, [esi + 0x16000]
mov eax, dword [edi]
or eax, eax
je 0x418e0e
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x1d208]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x1d290]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x418dcc
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x1d298]
or eax, eax
je 0x418e08
mov dword [ebx], eax
add ebx, 4
jmp 0x418de9
call dword [esi + 0x1d294]
mov ebp, dword [esi + 0x1d29c]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x21f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x418e42
sub esp, 0xffffff80
jmp 0x409b60
Function at 0x432003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
mov eax, section..text
nop
push 4
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
nop
nop
nop
cmp eax, 0
nop
je 0x432072
nop
nop
nop
mov ebx, 0x40c7d0
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x77174044
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
loop 0x432060
nop
nop
nop
nop
nop
mov eax, section..data
nop
cmp eax, 0
nop
nop
nop
nop
je 0x4320d2
nop
nop
mov ebx, 0x42f314
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
pop eax
mov esi, 0x5bd15b19
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x4320c0
nop
nop
nop
nop
popal
nop
jmp 0x431219