joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4a0f9d
Capabilities:
Encode data using xor

Disassembly:
dec ebp
or ebx, esi
nop
rcl bl, 0xd3
and eax, 0x1cbc6945
push ds
lodsd eax, dword [esi]
xor edx, ebx
xor dword [ebx + 0x38], ebx
mov bh, byte [edx + 0x3b]
nop
inc eax
xchg byte [ecx + 0x1ca25a0c], cl
inc eax
mov ch, 0x11
cwde
stc
mov esp, 0x3a931f64
inc esp
xor byte [ecx + ecx*4 + 0x59], 0xca
dec esi
jnp 0x4a0ff1
pop ds
insb byte es:[edi], dx
mov byte [0x33cf8663], al
ja 0x4a0f86
mov bh, 0xca
movsb byte es:[edi], byte [esi]
cli
sar byte [edi + esi*4 + 0x1e], 0xf2
dec ebp
in eax, dx
cmpsb byte [esi], byte es:[edi]
pop edx
aas
mov al, 0x88
in al, 0x76
mov word [eax + 0x13], es
scasd eax, dword es:[edi]
jb 0x4a0fb8
cmp edi, ebp
lea edi, [eax + 0x32]
in al, dx
loopne 0x4a1051
lodsb al, byte [esi]
inc byte [ecx]
inc edi
add al, 0x29
outsd dx, dword [esi]
push 0x34d13e7b
push es
test eax, 0x3a302a8e
mov byte [0xd2926e6e], al
cmp ah, byte [edx - 0x2d6d9192]
clc
shl ah, 0x42
mov eax, dword [0x4c0262be]
xor eax, dword [ebx - 0x4a4aaf4b]
js 0x4a0fed
pop esp
cdq
push edi
retf 0xe802
xor dl, byte [eax]
aas
adc ebx, edi
xor al, 0x7a
wait
xchg byte [eax], dl
cld
salc
xor esi, edx
test al, 0x12
push esi
aad 0x6d
mov dh, 0x78
movsd dword es:[edi], dword [esi]
test byte [eax - 0x65e50fe6], dh
invalid

Function at 0x5c59bd
Capabilities:
Authenticate hmac

Disassembly:
mov eax, dword [0x42ec58d2]
imul ebp, dword [esp + esi*8], 0xfffffff2
test dword [ebp - 0x48], edx
xchg byte gs:[edi + 0x48f997e4], dl
dec edi
cmp eax, 0xd701924c
in al, 0x2c
mov cl, byte [edi - 0x35]
dec edx
xlatb
loop 0x5c5a18
xchg esi, eax
jno 0x5c59e5
push ss
insd dword es:[edi], dx
insd dword es:[edi], dx
mov ebp, dword [esi - 0x6f2cda11]
mov dword [eax - 0x36], ecx
adc eax, 0xe23e117e
test dword [ebp - 0x1a], eax
cld
cmp byte ss:[edi - 0x4f4cfcd0], al
or eax, dword [esi - 0x6e]
adc dword [ebx + 0x7f9f0179], 0x8616c438
pop es
ja 0x5c5a74
xchg esp, eax
out 0x27, eax
invalid
les eax, [ebp - 0x1214a4a]
adc eax, 0xacf81f57
mov bh, 0x42
movsb byte es:[di], byte [si]
out 0x70, eax
adc al, 0x36
or al, 0x23
pushal
push ss
cmp dh, ah
salc
mov eax, dword [0x42075c87]
je 0x5c5a28
inc ebx
bnd ret 0xabc1
lodsd eax, dword [esi]
xor ebx, 0x5f99f7a0
and eax, 0x9cba1ea
xor al, 0xf0
retf
imul eax, dword [eax - 0x1f3d5a88], 0x17
dec ebx
mov bh, 0xa6
inc ecx
rcl byte [ebp - 0x2f8587a3]
xor cl, byte [edi + 7]
xor ch, byte [edi]
push ebp
daa
jbe 0x5c5a43
sub cl, byte [ecx - 0x1d0ed16b]
mov eax, 0x8ab8d5d6
xchg esp, eax
cmpsd dword [esi], dword es:[edi]
mov byte [ebp + 0x47d2ed62], al
fbstp tbyte [eax]
test eax, 0x7815b047
aad 0x69
xchg dword [ebx], edi
push 0x54
sub dl, dh
jo 0x5c5b24
movsd dword es:[edi], dword [esi]
aam 0x36
out dx, al
cmc
push esi
mov al, bl
mov esi, 0xc8819d95
inc edi
pop edx
inc eax
add edx, dword [ebx - 0x38ae01a3]
inc esp
pop ss
mov ecx, cs
xchg ebp, eax
invalid
push es
inc ebp
mov ah, byte [ecx - 0xee4159d]
xlatb
ret
Function at 0x41fa00
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, 0x415015
lea edi, [esi - 0x14015]
push edi
or ebp, 0xffffffff
jmp 0x41fa22
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x41fa29
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x41fa18
mov eax, 1
add ebx, ebx
jne 0x41fa3b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x41fa30
jne 0x41fa4c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x41fa30
xor ecx, ecx
sub eax, 3
jb 0x41fa60
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x41fad2
mov ebp, eax
add ebx, ebx
jne 0x41fa6b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x41fa78
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x41fa9c
inc ecx
add ebx, ebx
jne 0x41fa88
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x41fa7d
jne 0x41fa99
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x41fa7d
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x41fabc
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x41faad
jmp 0x41fa1e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x41fabc
add edi, ecx
jmp 0x41fa1e
pop esi
mov edi, esi
mov ecx, 0x68f
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x41fada
cmp byte [edi], 5
jne 0x41fada
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x41fadf
lea edi, [esi + 0x1d000]
mov eax, dword [edi]
or eax, eax
je 0x41fb4e
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x23a74]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x23b4c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x41fb0c
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x23b54]
or eax, eax
je 0x41fb48
mov dword [ebx], eax
add ebx, 4
jmp 0x41fb29
call dword [esi + 0x23b50]
mov ebp, dword [esi + 0x23b58]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x19f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x41fb82
sub esp, 0xffffff80
jmp section.UPX0
Function at 0x480bc0
Capabilities:
Compute adler32 checksum

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.00480bd0

Function at 0x480e50
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
test eax, eax
jne 0x480e5c
pop ebp
ret
mov dword [ebp + 0xc], eax
pop ebp
jmp fcn.00480e70

Function at 0x424040
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
sub esp, 0x350
push ebx
push ebp
push esi
mov esi, dword [esp + 0x360]
push edi
xor edi, edi
mov dword [esp + 0x14], ecx
push esi
mov dword [esp + 0x14], edi
call fcn.0040c9d0
add esp, 4
test eax, eax
je 0x42420e
mov ebx, dword [esp + 0x368]
test ebx, ebx
je 0x42420e
mov edi, dword [sym.imp.KERNEL32.DLL_lstrcpyA]
lea eax, [esp + 0x18]
push esi
push eax
call edi
lea ecx, [esp + 0x18]
push 0x104
push ecx
call fcn.0040ce70
mov ebp, dword [sym.imp.KERNEL32.DLL_lstrcatA]
add esp, 8
lea edx, [esp + 0x18]
push ebx
push edx
call ebp
lea eax, [esp + 0x220]
lea ecx, [esp + 0x18]
push eax
push ecx
call dword [sym.imp.KERNEL32.DLL_FindFirstFileA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x424137
call fcn.004246e0
lea edx, [esp + 0x11c]
push esi
push edx
call edi
lea eax, [esp + 0x11c]
push 0x104
push eax
call fcn.0040ce70
add esp, 8
lea ecx, [esp + 0x24c]
lea edx, [esp + 0x11c]
push ecx
push edx
call ebp
test byte [esp + 0x220], 0x10
jne 0x42411d
mov ecx, dword [esp + 0x14]
lea edx, [esp + 0x11c]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
test eax, eax
jl 0x42411d
inc dword [esp + 0x10]
lea eax, [esp + 0x220]
push eax
push ebx
call dword [sym.imp.KERNEL32.DLL_FindNextFileA]
test eax, eax
jne 0x4240c3
push ebx
call dword [sym.imp.KERNEL32.DLL_FindClose]
lea ecx, [esp + 0x18]
push esi
push ecx
call edi
lea edx, [esp + 0x18]
push 0x104
push edx
call fcn.0040ce70
add esp, 8
lea eax, [esp + 0x18]
push 0x42b1bc
push eax
call ebp
lea ecx, [esp + 0x220]
lea edx, [esp + 0x18]
push ecx
push edx
call dword [sym.imp.KERNEL32.DLL_FindFirstFileA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x4241fd
call fcn.004246e0
test byte [esp + 0x220], 0x10
je 0x4241e3
cmp byte [esp + 0x24c], 0x2e
je 0x4241e3
lea eax, [esp + 0x11c]
push esi
push eax
call edi
lea ecx, [esp + 0x11c]
push 0x104
push ecx
call fcn.0040ce70
add esp, 8
lea edx, [esp + 0x24c]
lea eax, [esp + 0x11c]
push edx
push eax
call ebp
mov ecx, dword [esp + 0x368]
lea edx, [esp + 0x11c]
push ecx
mov ecx, dword [esp + 0x18]
push edx
call fcn.00424040
add dword [esp + 0x10], eax
lea eax, [esp + 0x220]
push eax
push ebx
call dword [sym.imp.KERNEL32.DLL_FindNextFileA]
test eax, eax
jne 0x42417b
push ebx
call dword [sym.imp.KERNEL32.DLL_FindClose]
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x350
ret 8
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x350
ret 8
Function at 0xc3c058
Capabilities:
Decompress data using aplib

Disassembly:
call 0xc3c1a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, pe_nt_image_headers32
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0xc3c07e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xc3c06a
add dl, dl
jne 0xc3c089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xc3c0dc
xor eax, eax
add dl, dl
jne 0xc3c096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xc3c17d
add dl, dl
jne 0xc3c0a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xc3c0b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xc3c0bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xc3c0c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0xc3c0d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0xc3c075
mov eax, 1
add dl, dl
jne 0xc3c0ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xc3c0f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xc3c0e1
sub eax, ebx
mov ebx, 1
jne 0xc3c128
mov ecx, 1
add dl, dl
jne 0xc3c10e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xc3c119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xc3c105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xc3c075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0xc3c13f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xc3c14a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xc3c136
cmp eax, 0x7d00
jae 0xc3c16d
cmp eax, 0x500
jb 0xc3c168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xc3c075
cmp eax, 0x7f
ja 0xc3c170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xc3c075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0xc3c19e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0xc3c075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10

Function at 0x431005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
call 0x43100c
nop
nop
nop
nop
nop
pop eax
nop
add eax, 0x403e6a
nop
sub eax, 0x403e10
nop
nop
nop
mov ebx, dword [eax]
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
cmp ebx, ecx
nop
nop
jl 0x431030
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43101e
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp int.00401219
Function at 0x47b250
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x5e000]
push edi
or ebp, 0xffffffff
jmp 0x47b272
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x47b279
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x47b268
mov eax, 1
add ebx, ebx
jne 0x47b28b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x47b29c
jne 0x47b2bb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x47b2bb
dec eax
add ebx, ebx
jne 0x47b2a8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x47b280
add ebx, ebx
jne 0x47b2b7
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x47b30d
xor ecx, ecx
sub eax, 3
jb 0x47b2d3
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x47b342
sar eax, 1
mov ebp, eax
jmp 0x47b2de
add ebx, ebx
jne 0x47b2de
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x47b2ac
inc ecx
add ebx, ebx
jne 0x47b2ec
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x47b2ac
add ebx, ebx
jne 0x47b2f9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x47b2ee
jne 0x47b30a
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x47b2ee
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x47b32c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x47b31e
jmp 0x47b26e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x47b32c
add edi, ecx
jmp 0x47b26e
pop esi
mov edi, esi
mov ecx, 0xd4c
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x47b34a
cmp byte [edi], 0xe
jne 0x47b34a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x47b34f
lea edi, [esi + 0x78000]
mov eax, dword [edi]
or eax, eax
je 0x47b3be
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x85308]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x8534c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x47b37c
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x85354]
or eax, eax
je 0x47b3b8
mov dword [ebx], eax
add ebx, 4
jmp 0x47b399
call dword [esi + 0x85350]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x47b3ef
cmp al, 0xef
ja 0x47b3e2
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x47b3c4
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x47b3d1
mov ebp, dword [esi + 0x85358]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x23f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x47b423
sub esp, 0xffffff80
jmp 0x413f30
Function at 0x6c5a50
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x221000]
push edi
or ebp, 0xffffffff
jmp 0x6c5a72
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x6c5a79
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x6c5a68
mov eax, 1
add ebx, ebx
jne 0x6c5a8b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x6c5a9c
jne 0x6c5abb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x6c5abb
dec eax
add ebx, ebx
jne 0x6c5aa8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x6c5a80
add ebx, ebx
jne 0x6c5ab7
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x6c5b0d
xor ecx, ecx
sub eax, 3
jb 0x6c5ad3
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x6c5b42
sar eax, 1
mov ebp, eax
jmp 0x6c5ade
add ebx, ebx
jne 0x6c5ade
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x6c5aac
inc ecx
add ebx, ebx
jne 0x6c5aec
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x6c5aac
add ebx, ebx
jne 0x6c5af9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x6c5aee
jne 0x6c5b0a
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x6c5aee
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x6c5b2c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x6c5b1e
jmp 0x6c5a6e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x6c5b2c
add edi, ecx
jmp 0x6c5a6e
pop esi
mov edi, esi
mov ecx, 0xa344
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x6c5b4a
cmp byte [edi], 0x3e
jne 0x6c5b4a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x6c5b4f
lea edi, [esi + 0x2c1000]
mov eax, dword [edi]
or eax, eax
je 0x6c5bbe
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x2f24b8]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x2f25c0]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x6c5b7c
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x2f25c8]
or eax, eax
je 0x6c5bb8
mov dword [ebx], eax
add ebx, 4
jmp 0x6c5b99
call dword [esi + 0x2f25c4]
mov ebp, dword [esi + 0x2f25cc]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x21f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x6c5bf2
sub esp, 0xffffff80
jmp 0x61b960
Function at 0x6c5660
Capabilities:
Encode data using xor

Disassembly:
imul ebp, eax, 0xde0dc78f
imul ecx, ebx
mov esi, eax
push 0xede0f5
imul ebx, eax, 0xf41e9ca0
mov dl, 0x5b
and ecx, 0
movzx ebx, bh
xchg ebp, esi
mov bl, bh
xor eax, 0xe2a21e52
mov ebp, edx
add bh, cl
or esi, edx
mov edx, 0xffff95a3
sub bh, cl
xor edx, 0x6a2f
imul ebx, ebx
lea ebp, [0xfede1346]
xor edx, 0x8f3
test bh, dh
xadd ecx, edx
dec ebp
xchg bh, al
add ecx, 0x882
add bh, 0x80
test edx, ecx
mov dh, bh
xor eax, 0x68cc9653
cmp ecx, 0x15e
jbe 0x6c567b
js 0x6c56dc
test dl, 0xf1
sbb edx, edx
inc ebx
push ebp
push esi
movsx edi, dx
movzx ebp, bh
call 0x6c56e9
cmp edx, 0xbdc1
js 0x6c56f7
test ebp, ebp
mov al, dh
xchg bl, bh
test edx, esi
mov esi, 0x50ef746c
dec eax
jo 0x6c5705
cmp bh, ah
mov al, ch
push esi
xchg ah, bh
xchg ebx, ebx
imul eax, eax, 0x1be5cf02
pop edx
js 0x6c5717
cmp esi, ebp
dec ebx
je 0x6c5724
lea ebx, [0xc245ab02]
mov bl, 0xbe
movzx ebx, dx
add ecx, edx
and ebp, edi
add ebx, ecx
pop edx
test ecx, 0xbb1bf097
push esi
push 0xd0e658
imul esi, ecx
imul ebx, esi
test al, 0xf3
imul esi, eax
push edi
push ebx
sub bl, 0xb1
or ecx, edi
cmp ch, bh
imul esi, eax, 0x9549bdb3
test dh, al
inc ebp
cmp eax, 0x68f77597
mov esi, ebx
imul esi, ebp
lea esi, [0x5e329b0d]
xor al, 9
add edx, 0x75810
jno 0x6c5776
adc ch, bl
mov bh, ch
add edx, 0x3b5
inc eax
xor ecx, ebx
add al, 0xe9
inc edi
jne 0x6c5789
test dh, 0x7e
cmp ebx, ebx
inc ebx
inc esi
sbb ah, 0x26
lea eax, [0x50fbdef8]
or esi, 0xe1e67da6
imul ecx, ebp, 0x9b4caa8
mov ebx, ebp
mov ah, dh
jbe 0x6c57b1
imul esi, ecx, 0x1fa43675
dec ch
imul edi, edi, 0
dec ecx
or eax, 0xebb4708
xadd edi, ebx
imul ecx, edx
or esi, edi
dec eax
imul ecx, ecx, 0xe4dd8387
imul eax, ebp, 0x97d52225
sub ebp, edi
test ebp, esi
jbe 0x6c57df
sbb eax, 0xc720712c
test al, bh
inc eax
dec bh
movsx ebp, ch
sbb cl, cl
inc esi
dec edi
test ebp, 0x6c3284d
jmp edx
Function at 0x46d5d0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x4a000]
push edi
jmp 0x46d5ea
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x46d5f1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x46d5e0
mov eax, 1
add ebx, ebx
jne 0x46d603
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x46d614
jne 0x46d633
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x46d633
dec eax
add ebx, ebx
jne 0x46d620
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x46d5f8
add ebx, ebx
jne 0x46d62f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x46d685
xor ecx, ecx
sub eax, 3
jb 0x46d64b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x46d6ba
sar eax, 1
mov ebp, eax
jmp 0x46d656
add ebx, ebx
jne 0x46d656
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x46d624
inc ecx
add ebx, ebx
jne 0x46d664
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x46d624
add ebx, ebx
jne 0x46d671
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x46d666
jne 0x46d682
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x46d666
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x46d6a4
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x46d696
jmp 0x46d5e6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x46d6a4
add edi, ecx
jmp 0x46d5e6
pop esi
mov edi, esi
mov ecx, 0x14de
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x46d6c2
cmp byte [edi], 0x16
jne 0x46d6c2
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x46d6c7
lea edi, [esi + 0x69000]
mov eax, dword [edi]
or eax, eax
je 0x46d736
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x878a8]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x879b8]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x46d6f4
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x879c0]
or eax, eax
je 0x46d730
mov dword [ebx], eax
add ebx, 4
jmp 0x46d711
call dword [esi + 0x879bc]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x46d767
cmp al, 0xef
ja 0x46d75a
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x46d73c
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x46d749
mov ebp, dword [esi + 0x879c4]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x237]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x46d79b
sub esp, 0xffffff80
jmp 0x411221
Function at 0x12d9b
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push 0x18
call fcn.00015d02
add esp, 4
mov dword [ebp - 4], eax
mov ebx, eax
mov edi, eax
xor eax, eax
mov ecx, 6
rep stosd dword es:[edi], eax
push 8
call fcn.00015d02
add esp, 4
mov dword [ebp - 8], eax
mov ebx, eax
mov dword [ebx], 0
mov dword [ebx + 4], 0
mov dword [ebx], 0x19302
push ebx
add ebx, 4
push ebx
push 8
call fcn.00015d02
add esp, 4
pop ebx
mov dword [ebx], eax
mov edi, eax
mov esi, 0x19332
lodsd eax, dword [esi]
stosd dword es:[edi], eax
lodsd eax, dword [esi]
stosd dword es:[edi], eax
pop ebx
push dword [ebp + 8]
lea eax, [ebp - 8]
push eax
mov eax, dword [esp]
mov eax, dword [eax]
mov eax, dword [eax]
call dword [eax + 0x20]
mov dword [ebp - 0xc], eax
push 0
push 0
push 0x40
push dword [ebp - 0xc]
lea eax, [ebp - 4]
push eax
call fcn.00012d1b
push dword [ebp - 4]
call sub.ntoskrnl.exe_ZwDeleteFile
push eax
call fcn.00010f2b
jmp 0x12e49
push eax
mov ebx, dword [ebp - 4]
push ebx
call fcn.00015cfc
add esp, 4
mov ebx, dword [ebp - 8]
push ebx
mov eax, dword [ebx]
call dword [eax]
call fcn.00015cfc
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret 4
Function at 0x145cd
Capabilities:
Find process by pid

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
call sub.ntoskrnl.exe_PsLookupProcessByProcessId
mov dword [ebp - 4], eax
push dword [ebp - 4]
call fcn.00010f2b
test eax, eax
je 0x14638
lea eax, [ebp - 0xc]
push eax
push 2
call sub.HAL.dll_KeRaiseIrql
push dword [ebp - 8]
call sub.ntoskrnl.exe_KeAttachProcess
push dword [ebp + 0xc]
call sub.ntoskrnl.exe_ZwClose
mov dword [ebp - 4], eax
call sub.ntoskrnl.exe_KeDetachProcess
push dword [ebp - 0xc]
call sub.HAL.dll_KeLowerIrql
push dword [ebp - 4]
call fcn.00010f2b
jmp 0x14645
mov esp, ebp
pop ebp
ret 8

Function at 0x1d31f
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push edx
mov eax, dword [esp + 0x14]
mov word [esp], bp
call fcn.0001c449
pop eax
fcmovnb st(0), st(6)
push edx
pop ebp
mov eax, 0x36ba1ef4
mov dl, 0xdd
leave
and eax, 0xd6c53e9
xchg ebp, eax
cld
invalid
lea esp, [esp + 0x3c]
jp 0x1d3aa
jne 0x1db2d
lahf
pushal
push 0xda5d1e1
pushfd
mov eax, dword [esp + 0x38]
push dword [esp + 8]
push ecx
push edi
push 0xa4de0864
mov dword [0x19d68], eax
push esp
lea esp, [esp + 0x3c]
jmp 0x1d3f5
pushal
push dword [esp]
jmp 0x1d7a9
push 0x2a5ab142
lea esp, [esp + 0x28]
jne 0x1db2d
bswap ax
lea eax, [ebp - 0x4be7138e]
jmp 0x1ca47
call 0x1db32
Function at 0x40167e
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x30efb74]
sub esp, 0x400
push esi
mov esi, eax
shr esi, 3
push edi
mov edi, dword [0x30ef56c]
test esi, esi
je 0x4016c9
cmp eax, 0x959
jne 0x4016b5
push 0
lea eax, [ebp - 0x400]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov ecx, edi
call fcn.00401481
add edi, 8
dec esi
je 0x4016c9
mov eax, dword [0x30efb74]
jmp 0x40169d
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4