joyce8/EMBER2024-capa huggingface dataset:
Function at 0x455c24
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
push esi
test dl, dl
je 0x455c3b
add esp, 0xfffffff0
call fcn.00403b84
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.0041dff0
mov eax, dword [0x46c810]
cmp word [eax + 2], 0
jne 0x455c63
mov eax, dword [0x46c810]
mov dword [eax + 4], ebx
mov dword [eax], fcn.00457314
mov eax, dword [0x46c91c]
cmp word [eax + 2], 0
jne 0x455c7d
mov eax, dword [0x46c91c]
mov dword [eax + 4], ebx
mov dword [eax], fcn.0045750c
mov byte [ebx + 0x34], 0
mov dl, 1
mov eax, dword [0x4158a4]
call fcn.00403830
mov dword [ebx + 0x90], eax
mov dl, 1
mov eax, dword [0x4158a4]
call fcn.00403830
mov dword [ebx + 0xa8], eax
xor eax, eax
mov dword [ebx + 0x60], eax
xor eax, eax
mov dword [ebx + 0x84], eax
mov dword [ebx + 0x5c], 0xff000018
mov dword [ebx + 0x78], 0x1f4
mov byte [ebx + 0x7c], 1
xor eax, eax
mov dword [ebx + 0x80], eax
mov dword [ebx + 0x74], 0x9c4
mov byte [ebx + 0x88], 0
mov byte [ebx + 0x9d], 1
mov byte [ebx + 0xb4], 1
mov dl, 1
mov eax, dword [0x4205cc]
call fcn.00427f18
mov esi, eax
mov dword [ebx + 0x98], esi
push 0x455e04
mov eax, dword [0x46c6c8]
mov eax, dword [eax]
push eax
call sub.user32.dll_LoadIconA
mov edx, eax
mov eax, esi
call fcn.004282e8
mov eax, dword [ebx + 0x98]
mov dword [eax + 0x14], ebx
mov dword [eax + 0x10], 0x457aac
push pe_nt_image_headers32
lea eax, [ebp - 0x101]
push eax
mov eax, dword [0x46c6c8]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_GetModuleFileNameA_1
lea eax, [ebp - 0x101]
push eax
lea eax, [ebp - 0x101]
push eax
call sub.user32.dll_OemToCharA
lea eax, [ebp - 0x101]
mov dl, 0x5c
call fcn.0040cd20
test eax, eax
je 0x455d72
lea edx, [eax + 1]
lea eax, [ebp - 0x101]
call fcn.00408f48
lea eax, [ebp - 0x101]
mov dl, 0x2e
call fcn.0040cd48
test eax, eax
je 0x455d86
mov byte [eax], 0
lea eax, [ebp - 0x101]
inc eax
push eax
call sub.user32.dll_CharLowerA
lea eax, [ebx + 0x8c]
lea edx, [ebp - 0x101]
mov ecx, pe_nt_image_headers32
call fcn.004048a4
mov eax, dword [0x46c4f0]
cmp byte [eax], 0
jne 0x455dba
mov eax, ebx
call fcn.00455f2c
mov byte [ebx + 0x59], 1
mov byte [ebx + 0x5a], 1
mov byte [ebx + 0x5b], 1
mov byte [ebx + 0x9e], 1
xor eax, eax
mov dword [ebx + 0xa0], eax
mov eax, ebx
call fcn.00457c88
mov eax, ebx
call fcn.0045864c
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x455dfa
call fcn.00403bdc
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4561ac
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [0x46dbe4]
cmp dword [eax + 0x30], 0
je 0x456256
cmp dword [ebx + 0x94], 0
jne 0x456250
mov eax, dword [ebx + 0x30]
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x45613c
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x456250
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x456216
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x456250
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.00417d44
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x456225
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x456db8
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xa4], 0
je 0x456ded
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00404724
jmp 0x456dfa
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.00404688
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x457e64
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x457ea5
mov eax, esi
call fcn.0043e600
test al, al
je 0x457ea5
mov eax, dword [ebx + 0x84]
call fcn.0043e2fc
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x457ea5
push 0
mov eax, dword [ebx + 0x84]
call fcn.0043e2fc
push eax
call sub.user32.dll_ShowWindow
pop esi
pop ebx
ret
Function at 0x461f74
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x48], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
lea eax, [ebp - 0x10]
mov edx, dword [0x414e54]
call fcn.00404fcc
xor eax, eax
push ebp
push 0x4620b8
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x46c3d4], 0
jne 0x461fc7
mov ecx, dword [0x46c514]
mov dl, 1
mov eax, dword [0x407860]
call fcn.0040bf50
call fcn.00403fec
lea eax, [ebp - 0x20]
xor ecx, ecx
mov edx, 0x10
call fcn.004030a4
mov eax, ebx
call fcn.00404e9c
mov dword [ebp - 0x1c], eax
push esi
push edi
mov esi, 0x4620c8
lea edi, [ebp - 0x30]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop edi
pop esi
lea eax, [ebp - 0x30]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0xc]
call fcn.00405f50
xor eax, eax
mov dword [ebp - 8], eax
mov eax, ebx
call fcn.00404eac
test eax, eax
jle 0x46205f
mov dword [ebp - 4], 0x10
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x40]
push eax
call sub.kernel32.dll_GetComputerNameA
test eax, eax
je 0x462058
lea eax, [ebp - 0x44]
mov edx, ebx
call fcn.004048bc
mov eax, dword [ebp - 0x44]
push eax
lea eax, [ebp - 0x48]
lea edx, [ebp - 0x40]
mov ecx, 0x10
call fcn.004048a4
mov eax, dword [ebp - 0x48]
pop edx
call fcn.004086a0
test eax, eax
jne 0x462058
mov ebx, 0x15
jmp 0x462064
mov ebx, 0x10
jmp 0x462064
mov ebx, 0x15
lea eax, [ebp - 0x10]
push eax
push 1
lea eax, [ebp - 0x20]
push eax
push ebx
push 0
push esi
call dword [0x46c3d4]
call fcn.00461ecc
mov eax, dword [ebp - 8]
call fcn.00461ecc
mov eax, edi
mov edx, dword [ebp - 0xc]
call fcn.00405f68
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4620bf
lea eax, [ebp - 0x48]
mov edx, 2
call fcn.00404658
lea eax, [ebp - 0x10]
mov edx, dword [0x414e54]
call fcn.0040509c
ret
Function at 0x408346
Capabilities:
Encode data using xor

Disassembly:
mov dword [esp], 0x7e81c56
popal
or al, byte [eax]
pushfd
mov dword [esp + 4], eax
pushal
pushfd
pushfd
pushfd
mov dword [esp + 0x2c], 0x45b243
pushfd
push ebp
call fcn.00433a27
sar byte [esi + 0x19], cl
xor byte gs:[edx - 0x16], al
jnp 0x408370
or al, 0xcc
in al, 0x5a
mov edi, 0x206dea0a
xchg dword [edi + 0x5ef9725f], ecx
jbe 0x408389
or ecx, dword [ebx + 0x43e4e2a1]
xchg dword [ebx], esp
push ebx
dec edi
dec edi
sahf
rcl ebx, cl
shr esp, cl
shl dword [eax + 0x2d], 1
or al, dh
lcall 0xad89, 0xc160eace
and eax, 0xd7697078
add cl, byte ds:[esi]
mov dword [0x96f8c4f], eax
outsb dx, byte [esi]
jb 0x4083ac
pushal
sub eax, 0xce9ac60a
ljmp 0x7825
salc
int3
jg 0x408412
push es
add bh, 0x33
inc ecx
jne 0x40833c
popal
popfd
jl 0x4083f6
movsb byte es:[edi], byte [esi]
invalid
dec ebp
invalid
xor esi, dword [eax + edi*8 + 0x6ea422f]
mov edx, 0x179336ba
and bl, byte [edx + 0x2d]
cmp dh, dh
sbb cl, dh
sub eax, 0xce1af63a
out 0xb2, al
sar bh, cl
cmovae ecx, dword [edi + 0x53]
dec esi
adc bh, byte [esi]
jae 0x408403
xchg esp, eax
imul edx, dword [esi - 0x3aeadaa7], 0xeea58ad1
add al, 0x10
dec ebx
mov dword [0xbf3c36dc], eax
xchg ebp, eax
jae 0x4084b5
ljmp 0xb1e1:0xe27221b3
sahf
bound esi, qword [edx + 0x2e]
pop esi
pop edx
and ebp, dword [edi + 0x457d44fe]
push ecx
mov cs, word [esi + 0x41]
aas
push eax
adc al, 0xee
sub eax, 0x94a650a3
push ds
daa
xchg esi, eax
lahf
jnp 0x40850c
fnstsw word [ebx]
outsd dx, dword [esi]
push esp
push cs
sal byte [edx + 0x2bb2e309], cl
call dword [ebx + 0x57335f4f]
iretd
adc eax, 0x60000035
pushfd
call fcn.00458b54
movups xmmword [esp + 0x2920], xmm0
jmp 0x4be266

Function at 0x413e36
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00413cb5

Function at 0x4472bd
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov byte [esp], bh
pushal
mov dword [esp + 0x40], edx
push dword [esp + 8]
mov byte [esp + 4], cl
mov dword [esp + 0x40], ebx
push dword [esp]
jmp 0x4a57a2

Function at 0x44b7e9
Capabilities:
Packed with generic packer

Disassembly:
mov dword [esp], 0x22bb77e8
pushfd
call fcn.004b6313
or esp, dword [ebx]
mov esp, 0xea3dfd00
push ds
insb byte es:[edi], dx
mov cl, 0x61
insd dword es:[edi], dx
xor eax, 0x642d36d
push ss
shl byte [esi - 0x43cf066], cl
invalid

Function at 0x460a05
Capabilities:
Packed with generic packer

Disassembly:
cmp eax, dword [ebp - 0x33c]
lea esp, [esp + 4]
Function at 0x477148
Capabilities:
Encode data using xor

Disassembly:
xor al, 0x64
or al, 0x80
push eax
sub byte [edi - 0x220f99a7], bl
cdq
jns 0x47712b
std
int 0x50
stc
ljmp 0x860e
sbb al, 0x24
push dword [esp]
mov word [esp + 4], ax
mov dword [0x42a350], 0
add al, 0xc7
add eax, 0x42a350
add byte [eax], al
add byte [eax], al
pushfd
jmp 0x482158
and ch, cl
or edx, dword [ebp - 1]
jmp dword [esi + 0xf]
invalid
invalid
bswap bx
movsx bx, dl
not bh
nop
lea ebx, [ebx - 0x760da751]
call fcn.004983ad
outsb dx, byte [esi]
cmpsd dword [esi], dword es:[edi]
cmp byte [edx + eax*2 - 0x3bdd15c5], al
add al, cl
call 0x7faf0cd3
or esi, dword [esi + 0x3a]
pop esi
adc ah, dh
out dx, al
loope 0x4770ff
sbb esp, esp
xchg ebp, eax
pop esi
and dword [ecx], esi
adc dword [edx + ecx*4 + 0x17], 0x5717a14d
or edx, dword [edi + 0x3c42f318]
jge 0x477122
pushal
pop ebp
add dword ds:[esp + ecx*2 + 0x21], edx
cdq
or al, 0x84
aad 0x61
outsb dx, byte [esi]
cmp ah, byte [edx + 0x2e]
bound eax, qword [ebp + 0x7b]
inc ebp
jnp 0x477203
arpl sp, bx
jb 0x477142
fdiv qword [edx - 0x61]
scasb al, byte es:[edi]
salc
push 0x62
inc ebp
xor al, 0x4d
cmpsd dword [esi], dword es:[edi]
and byte [ebx + 0x61], 0xf8
jp 0x47719d
test eax, 0x31d191d0
inc edi
mov ebp, 0x8462acd0
cwde
add esp, dword [ebx + ebp + 0xdbbc3c]
fimul dword [esi - 0x7ad08a87]
test esp, edx
sbb esp, ebx
jne 0x477225
xor ecx, esp
outsd dx, dword [esi]
mov esi, 0x8b450fe3
xor ebx, dword [edx - 0x3b5356ca]
lcall 0x709d, 0x420ebe33
wait
loop 0x47719f
in al, 0x18
in al, 0xf4
or byte [edi - 5], 0xaf
and dword [edi + 0x77], 0xc60b51a8
and dword [edi + 0x77], 0xc60b51a8
jb 0x4771f2
sub eax, 0x4aca6a90
retf 0x3df2
cmp eax, 0x7f04a818
xor bl, byte [ecx]
scasd eax, dword es:[edi]
scasd eax, dword es:[edi]
mov byte [0xae831681], al
mov ah, 0x6a
sbb dl, byte [ebx - 0x69]
push eax
outsd dx, dword [esi]
pop edx
xor edx, edx
xchg byte [esi], ah
jmp 0x76f045f8
int3
clc
invalid

Function at 0x47cb24
Capabilities:
Encode data using xor

Disassembly:
xor dx, 0x199b
movzx edx, byte [ebp + ecx - 4]
and ch, al
mov ecx, edi
cmp ecx, 0xcccd6692
bt bx, 2
pushal
stc
and edx, 3
call fcn.0047d057
mov edx, 0xe87ae1ba
cmp ch, dl
cmp byte [eax], ah
xor eax, 0xb5ed3df5
imul ecx, dword es:[ebp + ebp*8 - 0x68de124b], 0xffffffaf
sub byte [ebp + eax*8 - 5], cl
invalid

Function at 0x47fbc4
Capabilities:
Packed with generic packer

Disassembly:
mov dword [0x42eea4], ecx
lea eax, [eax - 0x4170eda6]
mov dword [esp + 4], 0
movsx ax, cl
setl ah
movzx ax, cl
lea eax, [ecx + 0x7e14fe48]
mov dword [esp], 0x1000
lea eax, [0x7f76e3be]
call fcn.004d3999
jp 0x4d46f7
pushfd
mov byte [esp], ch
mov dword [esp], 0x22bbd640
pushal
mov dword [esp + 0x1c], 0x46e9b266
mov byte [esp], 0x3f
pushfd
lea esp, [esp + 0x20]
jmp loc.00401bfc
pushal
jmp fcn.0040b3c7
Function at 0x4853be
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov dword [esp + 0x20], 0x914ecb9
mov dword [esp + 8], eax
push 0xd84e3c5c
lea esp, [esp + 0x24]
jmp fcn.00401d37
mov dword [esp], 0x22b4be93
call fcn.004d2291
ja 0x485422
jecxz 0x485405
aaa
popal
cmp ch, dl
std
sbb esi, dword [edi]
sti
sub esp, dword [edi - 0x497d41f6]
rcl byte [esi + 0x72b682c6], cl
out 0x73, al
pop eax
out dx, al
push es
sbb dword [ebx + ebp*4], 0xf48cc501
sbb eax, 0x5249a895
jb 0x4853cd
fdivr st(6)
pop ecx
xchg ecx, eax
int 0x3b
xchg esi, eax
push ecx
scasb al, byte es:[edi]
cmp dl, byte [ebx + 0x4f62561f]
push ebx
sub dh, byte [esi - 0x11f578fd]
imul byte [edi]
jb 0x4853a3
inc ebp
sub eax, 0x5fa7531e
out dx, eax
mov bl, 0x97
je 0x485420
cmp dl, cl
insb byte es:[edi], dx
xor dword [ebp + edx*4 + 0x14], eax
imul esp, edx, 0x135810a9
adc al, 0x69
loop 0x4853cd
adc byte [eax + 0x13], bl
insb byte es:[edi], dx
jo 0x485415
stosb byte es:[edi], al
mov al, byte [0x5d1707bb]
pop ebp
loope 0x485453
push 0x5d46cbcf
jecxz 0x48542f
movsb byte es:[edi], byte [esi]
and al, 3
xor esp, dword [esp + esi*2 - 0x60]
invalid
invalid

Function at 0x48e461
Capabilities:
Packed with generic packer

Disassembly:
and al, 0x20
div byte [eax]
mov edi, 0x20d8e822
stc
dec dword [ebp - 0x4362a480]
ljmp 0x648d
leave
cmp byte [eax], al
add byte [esi + 0xf], ah
mov esi, 0x24648ac2
add al, 0xb8
mov esp, 0x9c0041d4
pushfd
pushfd
mov dword [esp + 0xc], ecx
call fcn.00485a78
jle 0x475c1b
adc bl, byte [esi + 0x57]
cmp ebp, edx
jl 0x475c5c
or al, dl
or al, bh
rol dword [ecx + 0x2c741191], 1
dec eax
popal
cmc
mov ch, 0xf9
ror byte [ebx + ecx + 0x79], 0x84
in eax, 0x99
das
dec ebx
dec ch
fsubr dword [eax]
dec edi
push ds
and eax, 0x2e385941
insb byte es:[edi], dx
cmp dword [edi - 0x80], esp
xor esp, esi
cmp dh, cl
xchg dword [ebx - 0x71], edx
popfd
insb byte es:[edi], dx
and al, 0x40
dec eax
add eax, 0xd006c9cd
sbb eax, 0x649ba0b0
add al, 0xed
sub dword [ebp + 0x7bd05ead], ecx
jmp 0x4e83bb41
mov dword [esp + 8], eax
jmp 0x475c7d

Function at 0x48f79b
Capabilities:
Encode data using xor

Disassembly:
lea esp, [esp + 0x38]
je 0x48f7bf
xor cl, bl
add cl, 0x22
movsx ecx, cl
bswap cx
not esi
bsr cx, sp
not ecx
btr ecx, 0x13
mov dword [ebp - 4], esi

Function at 0x491f4b
Capabilities:
Encode data using xor

Disassembly:
push 0x410
jmp 0x45e184
push dword [0x42ed80]
pop dword [esp]
push 0xbcbf3ba2
mov dword [esp], 0
jmp 0x43c2c5
Function at 0x497f6f
Capabilities:
Packed with generic packer

Disassembly:
push dword [esp + 0xc]
mov dword [esp + 0x24], 0x5d899530
pushal
mov byte [esp], 0xd3
pushfd
mov dword [esp], esi
lea esp, [esp + 0x48]
jmp fcn.00401e37
not ah
push dword [esp]
shld eax, esi, 0x12
mov eax, dword [ebp - 0x338]
cmp dh, 0xfd
cmp eax, dword [ebp - 0x33c]
pushal
pushfd
push esi
push 0x8dbdefbe
lea esp, [esp + 0x34]
jmp fcn.00460a0f
push 0x27d5bda1
mov dword [esp + 4], 0x22bc3b78
mov dword [esp], esi
pushal
jmp 0x44a6c0
mov word [esp], 0x230d
mov dword [esp], 0x22bb8516
jmp 0x4a6853
push ebx
pushal
call fcn.0043c3e1
salc
mov al, byte [esi]
jne 0x4a68aa
cmp dl, ch
xor edx, ebp
adc ecx, ebx
fstp dword [ecx + 0x3e82a7a9]
add dh, byte [esi + 0x4f]
sbb ebp, dword [ebx]
cmpsd dword [esi], dword es:[edi]
or bh, dh
out 0xb6, eax
jns 0x4a68ce
and cl, byte [esi + 0x52]
aas
xchg ah, dl
lodsb al, byte [esi]
scasb al, byte es:[edi]
cld
mov dh, 0xa
cmp bh, byte [eax + 0x30]
dec edi
nop
outsb dx, byte [esi]
sub bh, byte [ebp + 0x6a]
and bl, byte [edi + 0x5f]
ja 0x4a68c4
sub dword [esi - 0x2f248991], ecx
xchg ecx, eax
sar dword [edx], cl
fadd qword [ecx + ebx]
mov dword [edx + esi - 0x7207ea6c], ebp
arpl word [ecx - 0x76], si
adc esi, dword [edx + 0x2a9eca53]
invalid
retf 0x2a9e
jmp 0x46f4df
mov eax, es
std
cli
call dword [edi + 0x66]
bsf ebx, ebp
not si
adc bl, bh
mov ebx, dword [ebp - 0x324]
btr esi, 7
sub al, 0xfe
mov esi, dword [ebp - 0x328]
jmp 0x4604de
Function at 0x4e0704
Capabilities:
Encode data using xor

Disassembly:
mov word [esp + 8], bx
pushfd
mov dword [esp + 0x3c], 0x4ec55f
call fcn.004eac1c
stosb byte es:[edi], al
inc ebx
shr byte [esp + esi - 0x234fa916], 1
in al, 0xd5
xchg ebp, eax
ror dword [ecx + 0x74443db5], 0x80
inc ebx
test al, 0x60
test al, 0x58
xor byte [eax], 0x64
sbb al, 0x4c
or al, 0x1c
fsubr st(0), st(0)
mov ch, 0x48
inc ebx
out dx, al
or eax, 0xb4e0fab6
dec edx
lodsb al, byte [esi]
mov esp, 0xb13b8c7c
cmp byte [edx + eax*4 - 0x412d05b9], 0xfc
inc eax
stc
cmp esi, dword [ecx + 0x4782bc80]
cli
sar byte [esi - 0x69bbf04], cl
mov byte [edi - 0x40200465], dh
pop es
mov edx, 0x1f68f0b9
pop ecx
test byte [esi], bh
cmp dword [esp + edi + 0x64], esi
or byte [eax + 0x54], 0x6c
loop 0x4e071a
xor byte [eax], al
test byte [edx - 0x24], bh
popfd
pop ebp
xchg ecx, eax
xor esp, eax
jne 0x4e07f0
outsb dx, byte [esi]
adc byte [eax + 0x7b546ce2], ch
std
xchg ecx, eax
xlatb
imul esi, dword [ebx + 0x7f], 0x6a
sub dl, dh
fistp qword [esi + ebp + 0x1f]
sti
xchg ebp, eax
mov byte [ebx - 0x59], cl
nop
pop ebp
enter 0x37b6, 0x71
sbb esp, ebx
salc
xchg edx, eax
push cs
inc esi
push ecx
in eax, dx
xchg edx, eax
mov dl, 0xf9
clc
mov al, 0x70
xor al, 0x27
sbb byte [ebp + 0x7e], ah
lodsd eax, dword [esi]
movsd dword es:[edi], dword [esi]
add ebx, ebp
dec eax
or dword [edx - 0x74c21623], esp
xchg ebx, eax
stosd dword es:[edi], eax
nop
push eax
pop eax
xor eax, 0xc42c9cd4
loopne 0x4e0747
hlt
scasd eax, dword es:[edi]
adc ebx, dword [ecx - 0x1b]
or ebx, ebp
dec esp
adc eax, 0xd33105e3
inc ecx
insd dword es:[edi], dx
cmp eax, 0x921d6885
add dword fs:[eax + 0x48b1dc45], ebp
pop eax
in al, dx
and al, 0xcb
xor dl, ch
xchg edi, eax
mov edx, 0x6a1256ab
int 0x66
mov dword [esp], 0xc48861fc
Function at 0x401cd0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push 0x40
push 0x1000
mov eax, dword [ebp + 8]
push eax
push 0
call dword [sym.imp.KERNEL32.DLL_VirtualAlloc]
pop ebp
ret

Function at 0x401cf0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
mov eax, dword [ebp + 8]
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_CreateThread]
pop ebp
ret

Function at 0x4282a0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x17000]
push edi
jmp 0x4282ba
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x4282c1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4282b0
mov eax, 1
add ebx, ebx
jne 0x4282d3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x4282c8
jne 0x4282e4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4282c8
xor ecx, ecx
sub eax, 3
jb 0x4282f8
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x42836a
mov ebp, eax
add ebx, ebx
jne 0x428303
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x428310
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x428334
inc ecx
add ebx, ebx
jne 0x428320
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x428315
jne 0x428331
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x428315
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x428354
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x428345
jmp 0x4282b6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x428354
add edi, ecx
jmp 0x4282b6
pop esi
mov edi, esi
mov ecx, 0x115
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x428372
cmp byte [edi], 3
jne 0x428372
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x428377
lea edi, [esi + 0x26000]
mov eax, dword [edi]
or eax, eax
je 0x4283e6
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x28000]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x280c4]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x4283a4
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x280cc]
or eax, eax
je 0x4283e0
mov dword [ebx], eax
add ebx, 4
jmp 0x4283c1
call dword [esi + 0x280c8]
mov ebp, dword [esi + 0x280d0]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1ef]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x42841a
sub esp, 0xffffff80
jmp 0x409ac0
Function at 0x406475
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x4064b4
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4064b4
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4064b4
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x4064b4
cmp dword [ecx + 0x74], 0xe
jbe 0x4064b4
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x40ec83
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x41c220
push 0x41c218
push str.FlsAlloc
push 0x1f
call fcn.0040eb6a
mov esi, eax
add esp, 0x10
test esi, esi
je 0x40ecb7
push dword [ebp + 8]
mov ecx, esi
call dword [0x41912c]
call esi
jmp 0x40ecbd
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x40ed01
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x41c230
push 0x41c228
push str.FlsGetValue
push 0x21
call fcn.0040eb6a
mov esi, eax
add esp, 0x10
test esi, esi
je 0x40ed38
push dword [ebp + 8]
mov ecx, esi
call dword [0x41912c]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x40ed40
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x41c238
push 0x41c230
push str.FlsSetValue
push 0x22
call fcn.0040eb6a
mov esi, eax
add esp, 0x10
test esi, esi
je 0x40ed7a
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x41912c]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]