joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1003b977
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [0x1000a714]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x10009754
call fcn.10095123
mov edi, eax
lea eax, [ebp - 0x118]
xor esi, esi
push eax
mov dword [ebp - 0x118], 0x114
mov dword [ebp - 0x120], esi
call dword [sym.imp.kernel32.dll_GetVersionExW]
test eax, eax
je 0x1003b9d8
cmp dword [ebp - 0x108], 2
jne 0x1003b9d8
cmp dword [ebp - 0x114], 5
jb 0x1003b9d8
mov dword [ebp - 0x120], 1
test edi, edi
jne 0x1003ba6d
push 0x10009760
call fcn.10095123
test eax, eax
jne 0x1003ba6d
mov edi, 0x10009718
mov ebx, esi
cmp ebx, 0x3c
jae 0x1003ba12
push esi
push esi
push esi
push 0x10009970
push edi
call fcn.10095123
add ebx, 0x14
add edi, 0x14
test eax, eax
je 0x1003b9f5
mov edi, 0x10009718
test eax, eax
jne 0x1003ba6d
mov ebx, esi
cmp ebx, 0x3c
jae 0x1003ba3e
push dword [ebp - 0x120]
push esi
push 0x10009970
push edi
call fcn.10095123
add ebx, 0x14
add edi, 0x14
test eax, eax
je 0x1003ba1d
mov edi, 0x10009718
test eax, eax
jne 0x1003ba6d
cmp esi, 0x3c
jae 0x1003ba69
push 1
push dword [ebp - 0x120]
push 0x10009970
push edi
call fcn.10095123
add esi, 0x14
add edi, 0x14
test eax, eax
je 0x1003ba47
test eax, eax
je 0x1003ba72
mov eax, 0x80040201
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10049665
leave
ret

Function at 0x10048e3c
Capabilities:
Delete file

Disassembly:
push 8
mov eax, 0x100be4e0
call fcn.1004a336
mov esi, ecx
mov dword [ebp - 0x14], esi
mov dword [esi], 0x1000a6b8
push 3
pop edi
mov dword [ebp - 4], edi
mov byte [ebp - 4], 4
call fcn.10048fe1
mov eax, dword [esi + 0x14]
xor ebx, ebx
test eax, eax
je 0x10048e81
cmp word [eax], bx
je 0x10048e81
push eax
call dword [sym.imp.kernel32.dll_DeleteFileW]
test eax, eax
jne 0x10048e81
call dword [sym.imp.kernel32.dll_GetLastError]
mov dword [ebp - 4], edi
jmp 0x10048e98
mov byte [ebp - 4], 2
mov ecx, dword [esi + 0x138]
test ecx, ecx
je 0x10048eac
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov byte [ebp - 4], 1
lea ecx, [esi + 0xa4]
call fcn.1003709e
mov byte [ebp - 4], bl
lea ecx, [esi + 0x10]
call fcn.1003709e
or dword [ebp - 4], 0xffffffff
mov dword [esi], 0x1000a6b0
call fcn.1004a3db
ret
Function at 0x1005b8fc
Capabilities:
Delete directory

Disassembly:
push 0x10
mov eax, 0x100beb24
call fcn.1004a303
mov edi, ecx
mov dword [ebp - 0x10], edi
mov dword [edi], 0x1000ce54
mov dword [edi + 4], 0x1001f860
mov dword [edi + 0xc], 0x1000ce64
mov dword [edi + 0x10], 0x1000cea0
xor ebx, ebx
mov dword [ebp - 4], 2
cmp dword [edi + 0x38], ebx
je 0x1005b990
lea eax, [edi + 0x1e8]
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ebx
call fcn.1005e47a
mov esi, dword [ebp - 0x14]
call dword [sym.imp.kernel32.dll_GetCurrentThreadId]
cmp esi, eax
je 0x1005b964
push 0x326a6f78
call fcn.10095123
cmp dword [edi + 0x208], ebx
je 0x1005b976
push 0x326a6f79
call fcn.10095123
cmp dword [edi + 0x204], ebx
je 0x1005b988
push 0x326a6f7a
call fcn.10095123
lea ecx, [ebp - 0x1c]
call fcn.100515e1
mov ecx, dword [edi + 0x14]
test ecx, ecx
je 0x1005b9a0
mov eax, dword [ecx]
push 1
call dword [eax]
mov dword [edi + 0x14], ebx
mov ecx, dword [edi + 0x18]
test ecx, ecx
je 0x1005b9b0
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov dword [edi + 0x18], ebx
mov eax, dword [edi + 0x214]
cmp eax, 0xffffffff
je 0x1005b9c9
push eax
call dword [sym.imp.kernel32.dll_CloseHandle]
or dword [edi + 0x214], 0xffffffff
cmp dword [edi + 0x218], ebx
je 0x1005b9f7
lea esi, [edi + 0x21c]
push esi
call dword [sym.imp.kernel32.dll_RemoveDirectoryW]
test eax, eax
jne 0x1005b9ec
push 0x326a7030
call fcn.10095123
xor eax, eax
mov word [esi], ax
mov dword [edi + 0x218], ebx
lea eax, [edi + 0x1e8]
push eax
call dword [sym.imp.kernel32.dll_DeleteCriticalSection]
lea ecx, [edi + 0x40]
call fcn.1005a0fa
or dword [ebp - 4], 0xffffffff
mov ecx, edi
call fcn.1006499f
call fcn.1004a3db
ret
Function at 0x10095123
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
pushal
call 0x10095132
pop dword [ebp - 0x38]
mov eax, 0x775c09ab
sub eax, 0x6752b879
sub dword [ebp - 0x38], eax
mov dword [ebp - 0x48], 0xd8c7cc24
sub dword [ebp - 0x48], 0x8a7586d9
mov dword [ebp - 0x44], 0x704063ea
sub dword [ebp - 0x44], 0x3e0d17a5
mov dword [ebp - 0x40], 0x295423be
add dword [ebp - 0x40], 0x22f82070
mov dword [ebp - 0x3c], 0xf599d8de
add dword [ebp - 0x3c], 0xa662722
lea eax, [ebp - 0x48]
push eax
mov eax, 0x60a3e372
sub eax, 0x50a3d0ea
add eax, dword [ebp - 0x38]
call dword [eax]
mov dword [ebp - 0x48], 0xc2da92fe
add dword [ebp - 0x48], 0xb197d658
mov dword [ebp - 0x44], 0x6e4b1194
add dword [ebp - 0x44], 0xd3214fe1
mov dword [ebp - 0x40], 0x5ae4661a
add dword [ebp - 0x40], 0x88b0652
mov dword [ebp - 0x3c], 0x4500b27e
sub dword [ebp - 0x3c], 0x4500b27e
lea ebx, [ebp - 0x48]
push ebx
push eax
mov eax, 0x4e10bdba
sub eax, 0x3e10abba
add eax, dword [ebp - 0x38]
call dword [eax]
push 0x40
push 0x1000
push 0x5a1de
push 0
call eax
mov ecx, 0x5bf2a18
add ecx, 0xfa412742
mov edx, eax
mov edi, 0x23498ec5
sub edi, 0x133bf8c5
add edi, dword [ebp - 0x38]
mov esi, 0x74011fae
add esi, 0x6323f19a
sub dword [ebp - 0x18], 0x913ff75d
mov ebx, dword [edi]
sub dword [ebp - 0x2c], 0xc58955cc
sub ebx, esi
add dword [ebp - 0x20], 0xd685abfc
mov dword [edx], ebx
xor dword [ebp - 0x1c], ecx
add edx, 4
add edi, 0x3599b932
add edi, 0xca6646d2
loop 0x10095254
add eax, 0xbef1219b
add eax, 0x411016a0
xor ebx, ebx
add ebx, eax
add eax, 0x4c222d2c
sub eax, 0x4c222d27
mov ecx, 0x9fda0420
sub ecx, 0x8fda0420
add ecx, dword [ebp - 0x38]
call ebx
leave
ret

Function at 0x480428
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
pushal
mov ebx, dword [esp + 0x24]
mov ecx, ebx
add ebx, dword [ebx + 0x3c]
mov ebx, dword [ebx + 0x78]
add ebx, ecx
mov edi, dword [ebx + 0x20]
add edi, ecx
xor esi, esi
lea edx, [edi + esi*4]
mov edx, dword [edx]
add edx, ecx
xor eax, eax
rol eax, 7
xor al, byte [edx]
inc edx
cmp byte [edx], 0
jne 0x480447
cmp eax, dword [esp + 0x28]
je 0x48045e
inc esi
cmp esi, dword [ebx + 0x18]
jb 0x48043e
lea edx, [edi + esi*4]
mov edx, dword [edx]
add edx, ecx
mov dword [esp + 0x1c], edx
popal
ret 8
Function at 0x4148b0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, 0x411015
lea edi, [esi - 0x10015]
push edi
or ebp, 0xffffffff
jmp 0x4148d2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x4148d9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4148c8
mov eax, 1
add ebx, ebx
jne 0x4148eb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x4148e0
jne 0x4148fc
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4148e0
xor ecx, ecx
sub eax, 3
jb 0x414910
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x414982
mov ebp, eax
add ebx, ebx
jne 0x41491b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x414928
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x41494c
inc ecx
add ebx, ebx
jne 0x414938
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x41492d
jne 0x414949
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x41492d
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x41496c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x41495d
jmp 0x4148ce
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x41496c
add edi, ecx
jmp 0x4148ce
pop esi
mov edi, esi
mov ecx, 0x17
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x41498a
cmp byte [edi], 1
jne 0x41498a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x41498f
lea edi, [esi + 0x12000]
mov eax, dword [edi]
or eax, eax
je 0x4149fe
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x14340]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x1437c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x4149bc
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x14384]
or eax, eax
je 0x4149f8
mov dword [ebx], eax
add ebx, 4
jmp 0x4149d9
call dword [esi + 0x14380]
mov ebp, dword [esi + 0x14388]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x19f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x414a32
sub esp, 0xffffff80
jmp 0x401440
Function at 0x1005560e
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
pushal
call 0x1005561d
pop dword [ebp - 0x40]
mov eax, 0x8c39c3a6
add eax, 0x83cb9277
sub dword [ebp - 0x40], eax
mov dword [ebp - 0x50], 0x69473398
add dword [ebp - 0x50], 0xe50b11b3
mov dword [ebp - 0x4c], 0xf6901de
add dword [ebp - 0x4c], 0x22ca4a67
mov dword [ebp - 0x48], 0x363307ee
sub dword [ebp - 0x48], 0xe9e6c3c0
mov dword [ebp - 0x44], 0xdeb5f06b
add dword [ebp - 0x44], 0x214a0f95
lea eax, [ebp - 0x50]
push eax
mov eax, 0xbec6637a
sub eax, 0xaec0636a
add eax, dword [ebp - 0x40]
call dword [eax]
mov dword [ebp - 0x50], 0xf207e100
sub dword [ebp - 0x50], 0x7d9577aa
mov dword [ebp - 0x4c], 0x53cf1a71
sub dword [ebp - 0x4c], 0x1262b8fc
mov dword [ebp - 0x48], 0x55a97938
sub dword [ebp - 0x48], 0xf23a0ccc
mov dword [ebp - 0x44], 0xcf86a6be
add dword [ebp - 0x44], 0x30795942
lea ebx, [ebp - 0x50]
push ebx
push eax
mov eax, 0x53683c52
add eax, 0xbc9dc3c2
add eax, dword [ebp - 0x40]
call dword [eax]
push 0x40
push 0x1000
push 0x58d9e
push 0
call eax
mov ecx, 0xf89ab94f
add ecx, 0x7659ad6
mov esi, eax
mov edi, 0x8e6e841a
add edi, 0x819a37e6
add edi, dword [ebp - 0x40]
mov edx, 0x3a96b24e
xor dword [ebp - 0x30], edi
mov ebx, dword [edi]
xor dword [ebp - 0x1c], 0xbdc9cdf5
add ebx, edx
add dword [ebp - 0x24], eax
mov dword [esi], ebx
sub dword [ebp - 8], 0xbf79f090
add esi, 4
add edi, 0x9702e99d
sub edi, 0x9702e999
loop 0x10055739
add eax, 0x14367
xor ebx, ebx
add ebx, eax
add eax, 0xc20a0b56
add eax, 0x3df5f4af
mov ecx, 0xf3e1b680
sub ecx, 0xe3e1b680
add ecx, dword [ebp - 0x40]
call ebx
leave
ret
Function at 0x401ade
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x404028]
jne 0x401ae8
repz ret
jmp fcn.00401f54

Function at 0x419760
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, 0x40f015
lea edi, [esi - 0xe015]
push edi
or ebp, 0xffffffff
jmp 0x419782
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x419789
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x419778
nop
push 1
nop
pop eax
add ebx, ebx
jne 0x41979b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x419790
jne 0x4197ac
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x419790
sub ecx, ecx
sub eax, 3
jb 0x4197c0
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x419832
mov ebp, eax
add ebx, ebx
jne 0x4197cb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x4197d8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x4197fc
inc ecx
add ebx, ebx
jne 0x4197e8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x4197dd
jne 0x4197f9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4197dd
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x41981c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x41980d
jmp 0x41977e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x41981c
add edi, ecx
jmp 0x41977e
pop esi
push esi
pop edi
mov ecx, 0x2b3
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x41983a
cmp byte [edi], 5
jne 0x41983a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x41983f
lea edi, [esi + 0x17000]
mov eax, dword [edi]
or eax, eax
je 0x4198b7
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x19000]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x1908c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x41986c
push edi
pop ecx
jns 0x41989b
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x19090]
or eax, eax
je 0x4198b1
mov dword [ebx], eax
add ebx, 4
jmp 0x419889
call dword [esi + 0x190a0]
mov ebp, dword [esi + 0x19094]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x19f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x4198eb
sub esp, 0xffffff80
jmp 0x404c20
Function at 0x458f00
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x50000]
push edi
or ebp, 0xffffffff
jmp 0x458f22
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x458f29
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x458f18
mov eax, 1
add ebx, ebx
jne 0x458f3b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x458f4c
jne 0x458f6b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x458f6b
dec eax
add ebx, ebx
jne 0x458f58
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x458f30
add ebx, ebx
jne 0x458f67
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x458fbd
xor ecx, ecx
sub eax, 3
jb 0x458f83
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x458ff2
sar eax, 1
mov ebp, eax
jmp 0x458f8e
add ebx, ebx
jne 0x458f8e
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x458f5c
inc ecx
add ebx, ebx
jne 0x458f9c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x458f5c
add ebx, ebx
jne 0x458fa9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x458f9e
jne 0x458fba
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x458f9e
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x458fdc
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x458fce
jmp 0x458f1e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x458fdc
add edi, ecx
jmp 0x458f1e
pop esi
mov edi, esi
mov ecx, 0x47b
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x458ffa
cmp byte [edi], 6
jne 0x458ffa
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x458fff
lea edi, [esi + 0x56000]
mov eax, dword [edi]
or eax, eax
je 0x45906e
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x5b9f8]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x5ba64]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x45902c
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x5ba6c]
or eax, eax
je 0x459068
mov dword [ebx], eax
add ebx, 4
jmp 0x459049
call dword [esi + 0x5ba68]
mov ebp, dword [esi + 0x5ba70]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x20f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x4590a2
sub esp, 0xffffff80
jmp 0x406c40
Function at 0x10069281
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
pushal
call 0x10069290
pop dword [ebp - 0x14]
mov eax, 0xbd3a89ab
add eax, 0x52cc08e5
sub dword [ebp - 0x14], eax
push 0x40
push 0x1000
push 0x36f56
push 0
mov eax, 0x8fb0eb47
add eax, 0x805693e1
add eax, dword [ebp - 0x14]
call dword [eax]
mov ecx, 0x50b4e568
sub ecx, 0x50b49e2d
mov edi, eax
mov edx, 0xbec616dd
sub edx, 0xaebde8dd
add edx, dword [ebp - 0x14]
mov esi, 0xfaa991be
add esi, 0x8861ae0d
xor dword [ebp - 0x10], edx
mov ebx, dword [edx]
mov dword [ebp - 4], 0x191723d0
add ebx, esi
mov dword [ebp - 4], 0xd9f50fe5
mov dword [edi], ebx
add dword [ebp - 0xc], 0xf00bb61a
add edi, 0xe1f58364
add edi, 0x1e0a7ca0
add edx, 0x7955f210
add edx, 0x86aa0df4
loop 0x100692ef
add eax, 0x4fa2a366
add eax, 0xb05e6c59
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, sym.mozglue.dll_Ordinal_0
add ecx, dword [ebp - 0x14]
call ebx
leave
ret
Function at 0x4c6750
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x7b000]
push edi
or ebp, 0xffffffff
jmp 0x4c6772
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x4c6779
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4c6768
mov eax, 1
add ebx, ebx
jne 0x4c678b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x4c679c
jne 0x4c67bb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4c67bb
dec eax
add ebx, ebx
jne 0x4c67a8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x4c6780
add ebx, ebx
jne 0x4c67b7
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x4c680d
xor ecx, ecx
sub eax, 3
jb 0x4c67d3
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x4c6842
sar eax, 1
mov ebp, eax
jmp 0x4c67de
add ebx, ebx
jne 0x4c67de
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4c67ac
inc ecx
add ebx, ebx
jne 0x4c67ec
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4c67ac
add ebx, ebx
jne 0x4c67f9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x4c67ee
jne 0x4c680a
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4c67ee
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x4c682c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x4c681e
jmp 0x4c676e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x4c682c
add edi, ecx
jmp 0x4c676e
pop esi
mov edi, esi
mov ecx, 0x3887
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x4c684a
cmp byte [edi], 0x11
jne 0x4c684a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x4c684f
lea edi, [esi + 0xc2000]
mov eax, dword [edi]
or eax, eax
je 0x4c68c7
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xcc928]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xcca7c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x4c687c
mov ecx, edi
jns 0x4c68ab
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xcca80]
or eax, eax
je 0x4c68c1
mov dword [ebx], eax
add ebx, 4
jmp 0x4c6899
call dword [esi + 0xcca90]
mov ebp, dword [esi + 0xcca84]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x21f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x4c68fb
sub esp, 0xffffff80
jmp 0x417520
Function at 0x402fb0
Capabilities:
Terminate process

Disassembly:
mov ecx, 1
mov eax, 0x5305f8
nop word [eax + eax]
cmp dword [eax], 0
je 0x40300a
add eax, 0x4e0
inc ecx
cmp eax, 0x668118
jl 0x402fc0
push str.Limit_on_jobs_per_layout_has_been_exceeded.
push str.MAXPERLAYOUT
call fcn.0041b3d0
add esp, 8
push eax
push 0x10
push 0x4fd938
push str.ERROR
call fcn.0041b3d0
add esp, 8
push eax
call fcn.0041be10
add esp, 0xc
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov eax, ecx
ret
Function at 0x4049c0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
cmp dword [section..data], 0
je 0x404a06
call fcn.004179a0
mov eax, 0x530344
nop word [eax + eax]
mov dword [eax - 0x22c], 0
mov dword [eax], 0
add eax, 0x4e0
cmp eax, 0x668344
jl 0x4049e0
mov dword [section..data], 0
mov eax, dword [ebp + 8]
mov dword [0x668604], eax
cmp eax, 0x400
jl 0x404a4d
push str.Limit_on_jobs_per_layout_has_been_exceeded.
push str.MAXPERLAYOUT
call fcn.0041b3d0
add esp, 8
push eax
push 0x10
push 0x4fd938
push str.ERROR
call fcn.0041b3d0
add esp, 8
push eax
call fcn.0041be10
add esp, 0xc
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
imul eax, eax, 0x4e0
push 1
push dword [eax + 0x530344]
call fcn.00418480
push dword [0x668604]
call fcn.00412090
add esp, 0xc
pop ebp
ret

Function at 0x404ae0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x294
mov eax, dword [0x52de04]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
lea edx, [ebp - 0x108]
mov ecx, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0x18]
mov dword [ebp - 0x28c], eax
mov eax, dword [ebp + 0x10]
push esi
mov dword [ebp - 0x290], eax
xor esi, esi
mov eax, dword [ebp + 0x14]
sub edx, ecx
push edi
mov edi, dword [ebp + 0x1c]
mov dword [ebp - 0x294], eax
mov al, byte [ecx]
lea ecx, [ecx + 1]
mov byte [edx + ecx - 1], al
test al, al
jne 0x404b24
lea ecx, [ebp - 0x108]
lea edx, [ecx + 1]
nop word [eax + eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x404b40
sub ecx, edx
add ecx, 0xfffffffc
cmp ecx, 0x104
jae 0x404c85
mov byte [ebp + ecx - 0x108], al
lea eax, [ebp - 0x108]
push eax
push str.STEPREPEAT_1
call fcn.004129d0
mov ecx, eax
add esp, 8
test ecx, ecx
je 0x404c72
cmp byte [ecx], 0
je 0x404c72
lea edx, [ebp - 0x208]
sub edx, ecx
nop
mov al, byte [ecx]
lea ecx, [ecx + 1]
mov byte [edx + ecx - 1], al
test al, al
jne 0x404b90
lea eax, [ebp - 0x288]
push eax
lea eax, [ebp - 0x208]
push eax
call fcn.004170b0
push str.TEXTILE
call fcn.00416ad0
add esp, 0xc
test eax, eax
jne 0x404beb
push str.Repeats_printing_requires_Wasatch_SoftRIP_TX._n_nThis_option_has_not_been_activated_on_this_system.
push 0x10
push 0x4fd938
push str.ERROR
call fcn.0041b3d0
add esp, 8
push eax
call fcn.0041be10
add esp, 0xc
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov esi, dword [ebp - 0x28c]
test esi, esi
je 0x404c05
push dword [ebp - 0x288]
call fcn.004ccd89
fstp qword [esi]
add esp, 4
mov esi, dword [ebp - 0x290]
test esi, esi
je 0x404c1f
push dword [ebp - 0x284]
call fcn.004ccd89
fstp qword [esi]
add esp, 4
mov esi, dword [ebp - 0x294]
test esi, esi
je 0x404c39
push dword [ebp - 0x278]
call fcn.004ccd89
fstp qword [esi]
add esp, 4
test ebx, ebx
je 0x404c53
push dword [ebp - 0x274]
call fcn.004cd97e
add esp, 4
neg eax
sbb eax, eax
neg eax
mov dword [ebx], eax
test edi, edi
je 0x404c6d
push dword [ebp - 0x270]
call fcn.004cd97e
add esp, 4
neg eax
sbb eax, eax
neg eax
mov dword [edi], eax
mov esi, 1
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004b3f28
mov esp, ebp
pop ebp
ret
call fcn.004b3e4d
int3
Function at 0x406820
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x52de04]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x668774]
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
test eax, eax
je 0x40684b
push eax
call fcn.004c98b4
add esp, 4
push 0x100
call fcn.004c98cf
mov ebx, dword [ebp + 8]
mov esi, eax
add esp, 4
mov dword [0x668774], esi
xor ecx, ecx
mov eax, ecx
cdq
idiv edi
mov al, byte [edx + ebx]
mov byte [ebp + ecx - 0x104], al
inc ecx
cmp ecx, 0xfa
jl 0x406865
mov byte [ebp - 0xa], 0
xor eax, eax
mov byte [eax + esi], al
inc eax
cmp eax, 0x100
jb 0x406883
xor edi, edi
mov ecx, 0xfa
mov dword [ebp - 0x108], edi
nop dword [eax + eax]
mov eax, edi
mov bl, byte [edi + esi]
xor edx, edx
div ecx
movzx ecx, bl
movzx eax, byte [ebp + edx - 0x104]
add eax, dword [ebp - 0x108]
add ecx, eax
movzx ecx, cl
mov dword [ebp - 0x108], ecx
mov dword [0x66877c], ecx
mov al, byte [ecx + esi]
mov byte [ecx + esi], bl
mov ecx, 0xfa
mov byte [edi + esi], al
inc edi
cmp edi, 0x100
jb 0x4068a0
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
mov dword [0x668778], 0
pop ebx
mov dword [0x66877c], 0
call fcn.004b3f28
mov esp, ebp
pop ebp
ret