joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40595e
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
pushal
call 0x40596d
pop dword [ebp - 0x4c]
mov eax, 0x40596d
sub dword [ebp - 0x4c], eax
mov dword [ebp - 0x5c], 0x25f02c60
add dword [ebp - 0x5c], 0x286218eb
mov dword [ebp - 0x58], 0x70ab858c
add dword [ebp - 0x58], 0xc187c6b9
mov dword [ebp - 0x54], 0x19434f5d
add dword [ebp - 0x54], 0x3308f4d1
mov dword [ebp - 0x50], 0xd410f76a
sub dword [ebp - 0x50], 0xd410f76a
lea eax, [ebp - 0x5c]
push eax
mov eax, 0xe65fbf83
add eax, 0x19e0b0dd
add eax, dword [ebp - 0x4c]
call dword [eax]
mov dword [ebp - 0x5c], 0x8015d237
sub dword [ebp - 0x5c], 0xba368e1
mov dword [ebp - 0x58], 0xa49d4fee
sub dword [ebp - 0x58], 0x6330ee79
mov dword [ebp - 0x54], 0xa37a5bfb
sub dword [ebp - 0x54], 0x400aef8f
mov dword [ebp - 0x50], 0xa2f448cf
sub dword [ebp - 0x50], 0xa2f448cf
lea ebx, [ebp - 0x5c]
push ebx
push eax
mov eax, 0x524f85ae
sub eax, 0x520f14ae
add eax, dword [ebp - 0x4c]
call dword [eax]
push 0x40
push 0x1000
push 0x3645f
push 0
call eax
mov ecx, 0xd501147c
sub ecx, 0xd500ce42
mov esi, eax
mov edi, 0x410000
add edi, dword [ebp - 0x4c]
mov edx, 0x15c6b2c6
add edx, 0x6316e7e3
xor dword [ebp - 0x2c], esi
mov ebx, dword [edi]
sub dword [ebp - 0x34], ebx
xor ebx, edx
sub dword [ebp - 0x48], esi
mov dword [esi], ebx
sub dword [ebp - 0x34], esi
add esi, 0xb7c09ed6
sub esi, 0xb7c09ed2
add edi, 0xd23d22ee
sub edi, 0xd23d22ea
loop 0x405a84
add eax, 0x449f2c63
add eax, 0xbb61df58
mov ebx, eax
add eax, 5
mov ecx, 0xf84606ad
sub ecx, 0xf80606ad
add ecx, dword [ebp - 0x4c]
call ebx
leave
ret

Function at 0x4065b0
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x40c17c]
jne 0x4065ba
repz ret
jmp fcn.00406941
Function at 0x401000
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
je 0x401090
push ebp
mov ebp, dword [esp + 0x14]
push edi
mov edi, dword [esp + 0x10]
push ebx
cmp byte [esi], 0
je 0x40108d
push 0x5c
push esi
call dword [sym.imp.MSVCR71.dll_strchr]
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x40108d
push edi
mov byte [esi], 0
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x401066
push 0
push edi
call dword [sym.imp.kernel32.dll_CreateDirectoryA]
test eax, eax
jne 0x40105f
test ebp, ebp
je 0x40105f
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
jmp 0x401066
push edi
push 1
call ebp
pop ecx
pop ecx
test bl, 0x10
jne 0x401087
push 0xb7
call dword [sym.imp.kernel32.dll_SetLastError]
test ebp, ebp
je 0x401087
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
mov byte [esi], 0x5c
inc esi
jne 0x401018
pop ebx
pop edi
pop ebp
xor eax, eax
inc eax
pop esi
ret

Function at 0x40287f
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
pushal
call 0x40288e
pop dword [ebp - 0x14]
mov eax, 0x145d39a
sub eax, 0x105ab0c
sub dword [ebp - 0x14], eax
mov dword [ebp - 0x24], 0x4e31c7b6
sub dword [ebp - 0x24], 0xffdf826b
mov dword [ebp - 0x20], 0x87b5698b
sub dword [ebp - 0x20], 0x55821d46
mov dword [ebp - 0x1c], 0x81bba992
sub dword [ebp - 0x1c], 0x356f6564
mov dword [ebp - 0x18], 0xae9e5850
add dword [ebp - 0x18], 0x5161a7b0
lea eax, [ebp - 0x24]
push eax
mov eax, 0x17919d6d
add eax, 0xe8aee31f
add eax, dword [ebp - 0x14]
call dword [eax]
mov dword [ebp - 0x24], 0x3738028
sub dword [ebp - 0x24], 0x8f0116d2
mov dword [ebp - 0x20], 0x4f1bd134
sub dword [ebp - 0x20], 0xdaf6fbf
mov dword [ebp - 0x1c], 0x4960a5f6
sub dword [ebp - 0x1c], 0xe5f1398a
mov dword [ebp - 0x18], 0xcd5c88f8
add dword [ebp - 0x18], 0x32a37708
lea ebx, [ebp - 0x24]
push ebx
push eax
mov eax, 0xbaab8f5d
add eax, 0x4594f177
add eax, dword [ebp - 0x14]
call dword [eax]
push 0x40
push 0x1000
push 0x3a6be
push 0
call eax
mov ecx, 0x574d
xor edi, edi
add edi, eax
mov ebx, 0x411000
add ebx, dword [ebp - 0x14]
mov esi, 0x41021a54
sub esi, 0x2a32daf5
xor dword [ebp - 8], ecx
mov edx, dword [ebx]
sub edx, esi
sub dword [ebp - 4], 0xbcc500bd
mov dword [edi], edx
sub dword [ebp - 4], 0x48e9696c
add edi, 0x5d4fe7a
sub edi, 0x5d4fe76
add ebx, 0x43b2cb3e
add ebx, 0xbc4d34c6
loop 0x4029a6
add eax, 0xc1dfb237
add eax, 0x3e219dd0
xor ebx, ebx
add ebx, eax
add eax, 0x1bf69af1
sub eax, 0x1bf69aec
mov ecx, 0x7f95cba6
add ecx, 0x80aa345a
add ecx, dword [ebp - 0x14]
call ebx
leave
ret
Function at 0x632d3b60
Capabilities:
Packed with generic packer

Disassembly:
cmp byte [esp + 8], 1
jne 0x632d3d24
pushal
mov esi, 0x632d1015
lea edi, [esi - 0x10015]
push edi
or ebp, 0xffffffff
jmp 0x632d3b8a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x632d3b91
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x632d3b80
mov eax, 1
add ebx, ebx
jne 0x632d3ba3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x632d3b98
jne 0x632d3bb4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x632d3b98
xor ecx, ecx
sub eax, 3
jb 0x632d3bc8
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x632d3c3a
mov ebp, eax
add ebx, ebx
jne 0x632d3bd3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x632d3be0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x632d3c04
inc ecx
add ebx, ebx
jne 0x632d3bf0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x632d3be5
jne 0x632d3c01
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x632d3be5
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x632d3c24
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x632d3c15
jmp 0x632d3b86
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x632d3c24
add edi, ecx
jmp 0x632d3b86
pop esi
mov edi, esi
mov ecx, 0x34
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x632d3c42
cmp byte [edi], 0
jne 0x632d3c42
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x632d3c47
lea edi, [esi + 0x11000]
mov eax, dword [edi]
or eax, eax
je 0x632d3cb6
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x13000]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x13050]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x632d3c74
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x13054]
or eax, eax
je 0x632d3cb0
mov dword [ebx], eax
add ebx, 4
jmp 0x632d3c91
popal
xor eax, eax
ret 0xc
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x632d3ce7
cmp al, 0xef
ja 0x632d3cda
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x632d3cbc
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x632d3cc9
mov ebp, dword [esi + 0x13058]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x19f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x632d3d1b
sub esp, 0xffffff80
jmp 0x632c1530
Function at 0x401000
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
je 0x401090
push ebp
mov ebp, dword [esp + 0x14]
push edi
mov edi, dword [esp + 0x10]
push ebx
cmp byte [esi], 0
je 0x40108d
push 0x5c
push esi
call dword [sym.imp.MSVCRT.dll_strchr]
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x40108d
push edi
mov byte [esi], 0
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x401066
push 0
push edi
call dword [sym.imp.kernel32.dll_CreateDirectoryA]
test eax, eax
jne 0x40105f
test ebp, ebp
je 0x40105f
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
jmp 0x401066
push edi
push 1
call ebp
pop ecx
pop ecx
test bl, 0x10
jne 0x401087
push 0xb7
call dword [sym.imp.kernel32.dll_SetLastError]
test ebp, ebp
je 0x401087
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
mov byte [esi], 0x5c
inc esi
jne 0x401018
pop ebx
pop edi
pop ebp
xor eax, eax
inc eax
pop esi
ret

Function at 0x402bf1
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
pushal
call 0x402c00
pop dword [ebp - 8]
mov eax, 0xfd9ad708
sub eax, 0xfd5aab08
sub dword [ebp - 8], eax
mov dword [ebp - 0x18], 0x60331428
sub dword [ebp - 0x18], 0x11e0cedd
mov dword [ebp - 0x14], 0xee47db88
add dword [ebp - 0x14], 0x43eb70bd
mov dword [ebp - 0x10], 0x6963d31a
add dword [ebp - 0x10], 0xe2e87114
mov dword [ebp - 0xc], 0xf699d4b5
sub dword [ebp - 0xc], 0xf699d4b5
lea eax, [ebp - 0x18]
push eax
mov eax, 0x3cca8a33
sub eax, 0x3c8a19cf
add eax, dword [ebp - 8]
call dword [eax]
mov dword [ebp - 0x18], 0xfe8c0ece
add dword [ebp - 0x18], 0x75e65a88
mov dword [ebp - 0x14], 0xcb55c9e3
sub dword [ebp - 0x14], 0x89e9686e
mov dword [ebp - 0x10], 0x4598560d
sub dword [ebp - 0x10], 0xe228e9a1
mov dword [ebp - 0xc], 0xc6323744
add dword [ebp - 0xc], 0x39cdc8bc
lea ebx, [ebp - 0x18]
push ebx
push eax
mov eax, 0x3c53a3d7
sub eax, 0x3c13332f
add eax, dword [ebp - 8]
call dword [eax]
push 0x40
push 0x1000
push 0x390a6
push 0
call eax
mov ecx, 0x5168
xor edx, edx
add edx, eax
mov esi, 0x410000
add esi, dword [ebp - 8]
mov ebx, 0x15fa0ede
add ebx, 0xbfa0b8ff
xor dword [ebp - 4], 0x9595492e
mov edi, dword [esi]
sub dword [ebp - 4], edx
sub edi, ebx
mov dword [ebp - 4], 0x6c49f4df
mov dword [edx], edi
xor dword [ebp - 4], 0x97d74e04
add edx, 0xa696503b
add edx, 0x5969afc9
add esi, 0x46a97ec7
add esi, 0xb956813d
loop 0x402d18
add eax, 0x13873
mov ebx, eax
add eax, 0x7f98d352
add eax, 0x80672cb3
mov ecx, 0x400000
add ecx, dword [ebp - 8]
call ebx
leave
ret
Function at 0x4017c0
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
push ecx
push 0x19c
push 0
call dword [sym.imp.USER32.dll_LoadCursorW]
push 0x19c
push 0
call dword [sym.imp.USER32.dll_LoadCursorW]
push 0x19c
push 0
call dword [sym.imp.USER32.dll_LoadCursorW]
push 0x19c
push 0
call dword [sym.imp.USER32.dll_LoadCursorW]
push 0x19c
push 0
call dword [sym.imp.USER32.dll_LoadIconW]
test eax, eax
je 0x401810
xor eax, eax
jmp 0x4018f1
jmp loc.0045d80b
mov esp, ebp
pop ebp
ret

Function at 0x401ad0
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [0x4380c0], 0x24e1
mov eax, dword [0x4380c0]
sub eax, 0x24e1
mov dword [0x4380c0], eax
jmp loc.0045b96c

Function at 0x414b30
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0xe000]
push edi
or ebp, 0xffffffff
jmp 0x414b52
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x414b59
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x414b48
mov eax, 1
add ebx, ebx
jne 0x414b6b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x414b60
jne 0x414b7c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x414b60
xor ecx, ecx
sub eax, 3
jb 0x414b90
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x414c02
mov ebp, eax
add ebx, ebx
jne 0x414b9b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x414ba8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x414bcc
inc ecx
add ebx, ebx
jne 0x414bb8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x414bad
jne 0x414bc9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x414bad
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x414bec
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x414bdd
jmp 0x414b4e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x414bec
add edi, ecx
jmp 0x414b4e
pop esi
mov edi, esi
mov ecx, 0x43b
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x414c0a
cmp byte [edi], 0
jne 0x414c0a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x414c0f
lea edi, [esi + 0x12000]
mov eax, dword [edi]
or eax, eax
je 0x414c7e
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x15bbc]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x15c44]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x414c3c
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x15c4c]
or eax, eax
je 0x414c78
pop es
mov dword [ebx], eax
add ebx, 4
jmp 0x414c59
call dword [esi + 0x15c48]
mov ebp, dword [esi + 0x15c50]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x21f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x414cb2
sub esp, 0xffffff80
jmp 0x409820
Function at 0x4018d4
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push ecx
push edx
mov ecx, 0xfe
add ecx, 1
push ecx
push ebx
push 0x404734
call sub.KERNEL32.dll_lstrcpynA
pop edx
pop ecx
push ecx
push edx
push 0xfe
push 0x404734
push 0x404039
call fcn.004010ba
pop edx
pop ecx
push ecx
push edx
push 0xfe
push 0x404734
push 0x404062
call fcn.004010ba
pop edx
pop ecx
push esi
mov esi, dword [0x404c90]
call fcn.004010fc
push ecx
push edx
push 0x404ca0
push dword [0x404730]
call sub.KERNEL32.dll_lstrcpyA
pop edx
pop ecx
pop esi
push ecx
push edx
push 0xfe
push 0x404734
push dword [0x404730]
call fcn.004010ba
pop edx
pop ecx
push ecx
push edx
push 0xfe
push 0x404734
push 0x404077
call fcn.004010ba
pop edx
pop ecx
cmp dword [0x404c90], 0
jne 0x40199c
push ecx
push edx
mov ecx, 0xfe
add ecx, 1
push ecx
push 0x404038
push 0x404b74
call sub.KERNEL32.dll_lstrcpynA
pop edx
pop ecx
jmp 0x4019bc
push 0
push 0x100
push 0x404b74
push 0
push dword [0x404c90]
push 0
push 0x1200
call sub.KERNEL32.dll_FormatMessageA
push ecx
push edx
push 0xfe
push 0x404734
push 0x404039
call fcn.004010ba
pop edx
pop ecx
push ecx
push edx
push 0xfe
push 0x404734
push 0x404b74
call fcn.004010ba
pop edx
pop ecx
push ecx
push pe_overlay
push str.ERROR:
call fcn.00401000
push 0
push 0x404c88
push eax
push str.ERROR:
push dword [0x404c98]
call sub.KERNEL32.dll_WriteFile
pop ecx
mov eax, dword [0x404c88]
push ecx
push pe_overlay
push 0x404734
call fcn.00401000
push 0
push 0x404c88
push eax
push 0x404734
push dword [0x404c98]
call sub.KERNEL32.dll_WriteFile
pop ecx
mov eax, dword [0x404c88]
push 0xfe
push 0x404840
call sub.KERNEL32.dll_GetConsoleTitleA
push ecx
push edx
push 0x100
push 4
push 0x404950
push 0x404840
call fcn.00401072
pop edx
pop ecx
push ecx
push edx
mov eax, 0x100
cmp eax, 0x10000
jbe 0x401a84
mov eax, 0x10000
push eax
push str.CMD
push 0x404950
call fcn.0040101d
pop edx
pop ecx
je 0x401b24
push ecx
push edx
push 0x100
push 8
push 0x404950
push 0x404840
call fcn.00401072
pop edx
pop ecx
push ecx
push edx
mov eax, 0x100
cmp eax, 0x10000
jbe 0x401ac9
mov eax, 0x10000
push eax
push str.Command
push 0x404950
call fcn.0040101d
pop edx
pop ecx
je 0x401b24
push ecx
push pe_overlay
push str._r_n__press_ENTER:
call fcn.00401000
push 0
push 0x404c88
push eax
push str._r_n__press_ENTER:
push dword [0x404c98]
call sub.KERNEL32.dll_WriteFile
pop ecx
mov eax, dword [0x404c88]
push 0
push 0x404c88
push 1
push 0x404734
push dword [0x404c94]
call sub.KERNEL32.dll_ReadFile
mov eax, 0xffffffff
pop ebx
leave
ret 4

Function at 0x4023c6
Capabilities:
Write file on windows

Disassembly:
push esi
push 0
push 0x404c88
push 2
push 0x404001
inc eax
inc eax
add bh, bh
xor eax, 0x404d06

Function at 0x4023ea
Capabilities:
Write file on windows

Disassembly:
push 0x27
push 0x27
push 0x404ca0
mov al, byte [0xe800404c]
mov ebx, 0xbbfffff4
invalid
dec esp
inc eax
invalid
cmp byte [ebx], 0
je 0x402405
add ebx, 1
jmp 0x4023fb
sub ebx, 1
cmp ebx, 0x404ca0
jne 0x402415
mov byte [ebx], 0x30
jmp 0x402422
cmp byte [ebx], 0x30
jne 0x402422
mov byte [ebx], 0
sub ebx, 1
jmp 0x402408
cmp byte [ebx], 0x2e
Function at 0x402541
Capabilities:
Write file on windows

Disassembly:
mov edi, 0x404d10
mov ecx, 0x4070b0

Function at 0x401219
Capabilities:
Terminate process

Disassembly:
mov eax, dword fs:[0]
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x40501c
push 0x40109a
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
push eax
fnstcw word [esp]
or word [esp], 0x300
fldcw word [esp]
add esp, 4
push 0
push 0
push 0x405028
push 0x405024
push 0x405020
call sub.CRTDLL.DLL___GetMainArgs
push dword [0x405028]
push dword [0x405024]
push dword [0x405020]
mov dword [0x405014], esp
call fcn.0040129c
add esp, 0x18
sub ecx, ecx
mov dword [ebp - 4], ecx
push eax
call sub.CRTDLL.DLL_exit
leave
ret
Function at 0x5f63e0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x16f000]
push edi
or ebp, 0xffffffff
jmp 0x5f6402
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x5f6409
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x5f63f8
mov eax, 1
add ebx, ebx
jne 0x5f641b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x5f642c
jne 0x5f644b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x5f644b
dec eax
add ebx, ebx
jne 0x5f6438
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x5f6410
add ebx, ebx
jne 0x5f6447
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x5f649d
xor ecx, ecx
sub eax, 3
jb 0x5f6463
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x5f64d2
sar eax, 1
mov ebp, eax
jmp 0x5f646e
add ebx, ebx
jne 0x5f646e
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x5f643c
inc ecx
add ebx, ebx
jne 0x5f647c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x5f643c
add ebx, ebx
jne 0x5f6489
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x5f647e
jne 0x5f649a
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x5f647e
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x5f64bc
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x5f64ae
jmp 0x5f63fe
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x5f64bc
add edi, ecx
jmp 0x5f63fe
pop esi
mov edi, esi
mov ecx, 0x3cb
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x5f64da
cmp byte [edi], 0xa
jne 0x5f64da
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x5f64df
lea edi, [esi + 0x1f4000]
mov eax, dword [edi]
or eax, eax
je 0x5f6557
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x1f977c]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x1f984c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x5f650c
mov ecx, edi
jns 0x5f653b
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x1f9854]
or eax, eax
je 0x5f6551
mov dword [ebx], eax
add ebx, 4
jmp 0x5f6529
call dword [esi + 0x1f9850]
mov ebp, dword [esi + 0x1f9858]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x217]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x5f658b
sub esp, 0xffffff80
jmp 0x40507a
Function at 0x40944e
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
pushal
call 0x40945d
pop dword [ebp - 0x14]
mov eax, 0x392ebe2c
add eax, 0xc711d631
sub dword [ebp - 0x14], eax
push 0x40
push 0x1000
push 0x3a956
push 0
mov eax, 0x339a89c7
sub eax, 0x335837af
add eax, dword [ebp - 0x14]
call dword [eax]
mov ecx, 0x3ade
mov ebx, eax
mov edi, 0x72b9c049
sub edi, 0x72766c49
add edi, dword [ebp - 0x14]
mov edx, 0x96964995
add edx, 0xfc36c8ee
sub dword [ebp - 0xc], 0x396aef47
mov esi, dword [edi]
add dword [ebp - 4], 0x3f8e41e3
xor esi, edx
add dword [ebp - 4], 0x143ba3b6
mov dword [ebx], esi
add dword [ebp - 0xc], edi
add ebx, 4
add edi, 0xc26dee0f
sub edi, 0xc26dee0b
loop 0x4094b6
add eax, 0x6cb31029
sub eax, 0x6cb231de
mov ebx, eax
add eax, 0x851873d1
sub eax, 0x851873cc
mov ecx, 0x5d331a03
sub ecx, 0x5cf31a03
add ecx, dword [ebp - 0x14]
call ebx
leave
ret
Function at 0x46e970
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x5e000]
push edi
jmp 0x46e98a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x46e991
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x46e980
mov eax, 1
add ebx, ebx
jne 0x46e9a3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x46e9b4
jne 0x46e9d3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x46e9d3
dec eax
add ebx, ebx
jne 0x46e9c0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x46e998
add ebx, ebx
jne 0x46e9cf
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x46ea25
xor ecx, ecx
sub eax, 3
jb 0x46e9eb
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x46ea5a
sar eax, 1
mov ebp, eax
jmp 0x46e9f6
add ebx, ebx
jne 0x46e9f6
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x46e9c4
inc ecx
add ebx, ebx
jne 0x46ea04
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x46e9c4
add ebx, ebx
jne 0x46ea11
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x46ea06
jne 0x46ea22
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x46ea06
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x46ea44
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x46ea36
jmp 0x46e986
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x46ea44
add edi, ecx
jmp 0x46e986
pop esi
mov edi, esi
mov ecx, 0xa57
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x46ea62
cmp byte [edi], 0x12
jne 0x46ea62
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x46ea67
lea edi, [esi + 0x6c000]
mov eax, dword [edi]
or eax, eax
je 0x46eadf
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xb75e0]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xb76c0]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x46ea94
mov ecx, edi
jns 0x46eac3
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xb76c8]
or eax, eax
je 0x46ead9
mov dword [ebx], eax
add ebx, 4
jmp 0x46eab1
call dword [esi + 0xb76c4]
mov ebp, dword [esi + 0xb76cc]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x17f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x46eb13
sub esp, 0xffffff80
jmp 0x41942f