joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40216b
Capabilities:
Accept command line arguments
Parse pe header

Disassembly:
call main
jmp 0x402175
push 0x14
push 0x411788
call fcn.00405300
call main
movzx esi, ax
push 2
call main
pop ecx
mov eax, 0x5a4d
cmp word [0x400000], ax
je 0x4021a3
xor ebx, ebx
jmp 0x4021d6
mov eax, dword [0x40003c]
cmp dword [eax + 0x400000], 0x4550
jne 0x40219f
mov ecx, 0x10b
cmp word [eax + 0x400018], cx
jne 0x40219f
xor ebx, ebx
cmp dword [eax + 0x400074], 0xe
jbe 0x4021d6
cmp dword [eax + 0x4000e8], ebx
setne bl
mov dword [ebp - 0x1c], ebx
call fcn.004048ef
test eax, eax
jne 0x4021ea
push 0x1c
call main
pop ecx
call fcn.00403b58
test eax, eax
jne 0x4021fb
push 0x10
call main
pop ecx
call fcn.004051cc
and dword [ebp - 4], 0
call fcn.00404904
test eax, eax
jns 0x402215
push 0x1b
call main
pop ecx
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov dword [0x4162e8], eax
call main
mov dword [0x414430], eax
call main
test eax, eax
jns 0x40223b
push 8
call main
pop ecx
call fcn.00404de7
test eax, eax
jns 0x40224c
push 9
call main
pop ecx
push 1
call main
pop ecx
test eax, eax
je 0x40225f
push eax
call main
pop ecx
call fcn.00405299
push esi
push eax
push 0
push 0x400000
call main
mov esi, eax
mov dword [ebp - 0x24], esi
test ebx, ebx
jne 0x402281
push esi
call main
call fcn.00404663
jmp 0x4022b6
mov dword [ebp - 4], 0xfffffffe
mov eax, esi
call fcn.00405345
ret

Function at 0x40369f
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
pushal
call 0x4036ae
pop dword [ebp - 0x44]
mov eax, 0x4036ae
sub dword [ebp - 0x44], eax
mov dword [ebp - 0x54], 0x19f16850
add dword [ebp - 0x54], 0x3460dcfb
mov dword [ebp - 0x50], 0xa97d4b77
add dword [ebp - 0x50], 0x88b600ce
mov dword [ebp - 0x4c], 0xa8b3c379
add dword [ebp - 0x4c], 0xa39880b5
mov dword [ebp - 0x48], 0x6903b286
sub dword [ebp - 0x48], 0x6903b286
lea eax, [ebp - 0x54]
push eax
mov eax, 0x2ab760a0
add eax, 0xd5896f94
add eax, dword [ebp - 0x44]
call dword [eax]
mov dword [ebp - 0x54], 0x90a68f75
add dword [ebp - 0x54], 0xe3cbd9e1
mov dword [ebp - 0x50], 0x29ba6c58
add dword [ebp - 0x50], 0x17b1f51d
mov dword [ebp - 0x4c], 0xe2a97d03
add dword [ebp - 0x4c], 0x80c5ef69
mov dword [ebp - 0x48], 0x4cff6086
sub dword [ebp - 0x48], 0x4cff6086
lea ebx, [ebp - 0x54]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x44]
call dword [eax]
push 0x40
push 0x1000
push 0x374f7
push 0
call eax
mov ecx, 0xc9252209
sub ecx, 0xc924e015
mov edx, eax
mov ebx, 0x421000
add ebx, dword [ebp - 0x44]
mov edi, 0x6188b304
xor dword [ebp - 0x3c], edi
mov esi, dword [ebx]
mov dword [ebp - 8], 0x2a9ef353
xor esi, edi
xor dword [ebp - 0x34], edi
mov dword [edx], esi
xor dword [ebp - 8], 0xd20254e4
add edx, 0x21cd078c
add edx, 0xde32f878
add ebx, 0x3d2648cb
add ebx, 0xc2d9b739
loop 0x4037ba
add eax, 0x79a29687
sub eax, 0x79a19be4
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x400000
add ecx, dword [ebp - 0x44]
call ebx
leave
ret
Function at 0x10025a5
Capabilities:
Accept command line arguments
Create process on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x58
push ebx
push esi
push edi
push 0x44
pop esi
push esi
xor ebx, ebx
lea eax, [ebp - 0x58]
push ebx
push eax
mov dword [ebp - 4], 0x57
call fcn.01002b50
xor eax, eax
lea edi, [ebp - 0x14]
stosd dword es:[edi], eax
add esp, 0xc
stosd dword es:[edi], eax
push ebx
push ebx
stosd dword es:[edi], eax
push 1
push ebx
mov dword [ebp - 0x58], esi
stosd dword es:[edi], eax
call dword [sym.imp.KERNEL32.dll_HeapSetInformation]
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov esi, eax
cmp esi, ebx
je 0x1002684
cmp dword [ebp + 8], 3
jl 0x1002684
mov edi, dword [ebp + 0xc]
push 0x100116c
push dword [edi + 8]
call fcn.01002aa9
pop ecx
pop ecx
test eax, eax
jne 0x1002684
push dword [edi + 4]
call fcn.010028dd
and eax, 0xfff7fff3
pop ecx
or eax, 0x10
jmp 0x100262c
cmp cx, 0x2d
je 0x1002634
inc esi
inc esi
movzx ecx, word [esi]
cmp cx, bx
jne 0x1002624
lea ecx, [ebp - 0x14]
push ecx
lea ecx, [ebp - 0x58]
push ecx
push ebx
push ebx
push eax
push ebx
push ebx
push ebx
add esi, 6
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x100265c
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
jmp 0x1002684
push 0xffffffffffffffff
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
push dword [ebp - 0x14]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x10]
call esi
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x1002f7b
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
xor ebx, ebx
xor esi, esi
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 4], esi
cmp edi, dword [esi*8 + 0x100a018]
je 0x1002fa1
inc esi
mov dword [ebp - 4], esi
cmp esi, 0x17
jb 0x1002f8f
cmp esi, 0x17
jae 0x10030fb
push 3
call fcn.01005e22
pop ecx
cmp eax, 1
je 0x10030c5
push 3
call fcn.01005e22
pop ecx
test eax, eax
jne 0x1002fd4
cmp dword [section..data], 1
je 0x10030c5
cmp edi, 0xfc
je 0x10030fb
push 0x1001734
mov edi, 0x314
push edi
mov esi, 0x100adf8
push esi
call fcn.01005db5
add esp, 0xc
test eax, eax
je 0x100300a
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.01005179
add esp, 0x14
mov byte [0x100af15], bl
push 0x104
mov ebx, 0x100ae11
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x100304d
push 0x100171c
push 0x2fb
push ebx
call fcn.01005db5
add esp, 0xc
test eax, eax
je 0x100304d
xor eax, eax
push eax
push eax
push eax
push eax
push eax
call fcn.01005179
add esp, 0x14
push ebx
push edi
push esi
call fcn.01005d3c
add esp, 0xc
xor ebx, ebx
test eax, eax
je 0x100306b
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.01005179
add esp, 0x14
push 0x1001718
push edi
push esi
call fcn.01005d3c
add esp, 0xc
test eax, eax
je 0x100308b
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.01005179
add esp, 0x14
mov eax, dword [ebp - 4]
push dword [eax*8 + 0x100a01c]
push edi
push esi
call fcn.01005d3c
add esp, 0xc
test eax, eax
je 0x10030b0
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.01005179
add esp, 0x14
push 0x12010
push 0x10016f0
push esi
call fcn.01005b95
add esp, 0xc
jmp 0x10030fb
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov edi, eax
cmp edi, ebx
je 0x10030fb
cmp edi, 0xffffffff
je 0x10030fb
mov edx, dword [esi*8 + 0x100a01c]
mov ecx, edx
lea esi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10030e4
push ebx
lea eax, [ebp - 8]
push eax
sub ecx, esi
push ecx
push edx
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x10036c5
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x100b31c]
push ebx
push esi
xor ebx, ebx
xor esi, esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov dword [ebp - 4], ebx
cmp eax, ebx
jne 0x1003714
call edi
mov esi, eax
cmp esi, ebx
je 0x10036fa
mov dword [0x100b31c], 1
jmp 0x1003719
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x78
jne 0x100370f
push 2
pop eax
mov dword [0x100b31c], eax
jmp 0x1003714
mov eax, dword [0x100b31c]
cmp eax, 1
jne 0x1003774
cmp esi, ebx
jne 0x100372c
call edi
mov esi, eax
cmp esi, ebx
jne 0x100372c
xor eax, eax
jmp 0x1003845
mov eax, esi
cmp word [esi], bx
je 0x1003741
inc eax
inc eax
cmp word [eax], bx
jne 0x1003733
inc eax
inc eax
cmp word [eax], bx
jne 0x1003733
sub eax, esi
inc eax
inc eax
push eax
mov dword [ebp - 4], eax
call fcn.01006136
mov edi, eax
pop ecx
cmp edi, ebx
jne 0x1003765
xor edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, edi
jmp 0x1003845
push dword [ebp - 4]
push esi
push edi
call fcn.01006210
add esp, 0xc
jmp 0x1003757
cmp eax, 2
je 0x100377d
cmp eax, ebx
jne 0x1003725
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStrings]
mov esi, eax
mov dword [ebp - 8], esi
cmp esi, ebx
je 0x1003725
cmp byte [esi], bl
je 0x10037be
push ebx
push ebx
push 0xffffffffffffffff
push esi
push 1
push ebx
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
cmp eax, ebx
je 0x1003725
add dword [ebp - 4], eax
mov eax, esi
lea edi, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x10037aa
sub eax, edi
lea esi, [esi + eax + 1]
cmp byte [esi], bl
jne 0x1003790
mov esi, dword [ebp - 8]
inc dword [ebp - 4]
push 2
push dword [ebp - 4]
call fcn.0100609c
mov edi, eax
pop ecx
pop ecx
mov dword [ebp - 0xc], edi
cmp edi, ebx
jne 0x10037e2
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
jmp 0x1003725
mov eax, dword [ebp - 8]
cmp byte [eax], bl
je 0x1003834
mov ecx, dword [ebp - 4]
mov eax, edi
sub eax, dword [ebp - 0xc]
sar eax, 1
sub ecx, eax
push ecx
push edi
push 0xffffffffffffffff
push esi
push 1
push ebx
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
je 0x100384a
mov eax, esi
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
cmp dl, bl
jne 0x100380c
sub eax, ecx
lea esi, [esi + eax + 1]
mov eax, edi
lea ecx, [eax + 2]
mov dx, word [eax]
inc eax
inc eax
cmp dx, bx
jne 0x100381e
sub eax, ecx
sar eax, 1
lea edi, [edi + eax*2 + 2]
cmp byte [esi], bl
jne 0x10037e9
push dword [ebp - 8]
xor eax, eax
mov word [edi], ax
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
mov eax, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
leave
ret
push dword [ebp - 0xc]
call fcn.01005e72
pop ecx
push dword [ebp - 8]
jmp 0x10037d7
Function at 0x1003860
Capabilities:
Accept command line arguments

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [0x100b320]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetCommandLineW]
test eax, eax
jne 0x10038a4
call esi
test eax, eax
je 0x1003889
mov dword [0x100b320], 1
jmp 0x10038a9
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x78
jne 0x10038a0
mov dword [0x100b320], 2
jmp 0x10038b2
xor eax, eax
jmp 0x1003908
cmp eax, 1
jne 0x10038ad
call esi
jmp 0x1003908
cmp eax, 2
jne 0x10038a0
push edi
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov esi, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push 0
push 0
push 0xffffffffffffffff
push eax
push 1
push 0
mov dword [ebp - 8], eax
call esi
mov edi, eax
test edi, edi
je 0x1003905
push 2
push edi
call fcn.0100609c
pop ecx
pop ecx
mov dword [ebp - 4], eax
test eax, eax
je 0x1003905
push edi
push eax
push 0xffffffffffffffff
push dword [ebp - 8]
push 1
push 0
call esi
test eax, eax
je 0x10038fc
mov eax, dword [ebp - 4]
jmp 0x1003907
push dword [ebp - 4]
call fcn.01005e72
pop ecx
xor eax, eax
pop edi
pop esi
leave
ret
Function at 0x1003f89
Capabilities:
Allocate thread local storage
Set thread local storage value

Disassembly:
mov edi, edi
push ebx
push esi
push edi
push 0x1001760
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov edi, eax
xor ebx, ebx
cmp edi, ebx
je 0x1003fdb
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x10017cc
push edi
call esi
push 0x10017c0
push edi
mov dword [0x100b324], eax
call esi
push 0x10017b4
push edi
mov dword [0x100b328], eax
call esi
push 0x10017ac
push edi
mov dword [0x100b32c], eax
call esi
mov dword [0x100b330], eax
mov esi, dword [sym.imp.KERNEL32.dll_TlsSetValue]
cmp dword [0x100b324], ebx
je 0x1004001
cmp dword [0x100b328], ebx
je 0x1004001
cmp dword [0x100b32c], ebx
je 0x1004001
cmp dword [0x100b330], ebx
jne 0x1004025
mov eax, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [0x100b328], eax
mov eax, dword [sym.imp.KERNEL32.dll_TlsFree]
mov dword [0x100b324], 0x1003c4d
mov dword [0x100b32c], esi
mov dword [0x100b330], eax
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x100a17c], eax
cmp eax, 0xffffffff
je 0x1004098
push dword [0x100b328]
push eax
call esi
test eax, eax
je 0x1004098
call fcn.01002f34
push dword [0x100b324]
call fcn.01003b4f
push dword [0x100b328]
mov dword [0x100b324], eax
call fcn.01003b4f
push dword [0x100b32c]
mov dword [0x100b328], eax
call fcn.01003b4f
push dword [0x100b330]
mov dword [0x100b32c], eax
call fcn.01003b4f
add esp, 0x10
mov dword [0x100b330], eax
call fcn.010054a5
test eax, eax
jne 0x100409e
call fcn.01003c8a
xor eax, eax
pop edi
pop esi
pop ebx
ret
push 0x1003e39
push dword [0x100b324]
call fcn.01003bd5
pop ecx
call eax
mov dword [0x100a180], eax
cmp eax, 0xffffffff
je 0x1004093
push 0x214
push 1
call fcn.0100657a
mov esi, eax
pop ecx
pop ecx
cmp esi, ebx
je 0x1004093
push esi
push dword [0x100a180]
push dword [0x100b32c]
call fcn.01003bd5
pop ecx
call eax
test eax, eax
jne 0x10040f1
push esi
call fcn.01005e72
pop ecx
jmp 0x1004093
push ebx
push esi
call fcn.01003ccc
or dword [esi + 4], 0xffffffff
pop ecx
xor eax, eax
pop ecx
inc eax
jmp 0x100409a
Function at 0x1005b95
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.01003bc7
xor ebx, ebx
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ebx
cmp dword [0x100b4f0], ebx
jne 0x1005c6e
push ebx
push ebx
push 0x1001954
call dword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov edi, eax
cmp edi, ebx
jne 0x1005bd9
xor eax, eax
jmp 0x1005d32
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x1001948
push edi
call esi
cmp eax, ebx
je 0x1005bd2
push eax
call fcn.01003b4f
mov dword [esp], 0x1001938
push edi
mov dword [0x100b4f0], eax
call esi
push eax
call fcn.01003b4f
mov dword [esp], 0x1001924
push edi
mov dword [0x100b4f4], eax
call esi
push eax
call fcn.01003b4f
mov dword [0x100b4f8], eax
lea eax, [ebp - 8]
push eax
call fcn.01002cef
pop ecx
pop ecx
test eax, eax
je 0x1005c3c
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.01005179
add esp, 0x14
cmp dword [ebp - 8], 2
jne 0x1005c6e
push 0x1001908
push edi
call esi
push eax
call fcn.01003b4f
pop ecx
mov dword [0x100b500], eax
cmp eax, ebx
je 0x1005c6e
push 0x10018f0
push edi
call esi
push eax
call fcn.01003b4f
pop ecx
mov dword [0x100b4fc], eax
mov eax, dword [0x100b4fc]
mov esi, dword [ebp - 0x10]
cmp eax, esi
je 0x1005ce7
cmp dword [0x100b500], esi
je 0x1005ce7
push eax
call fcn.01003bd5
pop ecx
call eax
cmp eax, ebx
je 0x1005cb4
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
push dword [0x100b500]
call fcn.01003bd5
pop ecx
call eax
test eax, eax
je 0x1005cb4
test byte [ebp - 0x18], 1
jne 0x1005ce7
lea eax, [ebp - 0xc]
push eax
call fcn.01002d30
pop ecx
test eax, eax
je 0x1005ccf
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.01005179
add esp, 0x14
cmp dword [ebp - 0xc], 4
jb 0x1005cde
or dword [ebp + 0x10], 0x200000
jmp 0x1005d18
or dword [ebp + 0x10], 0x40000
jmp 0x1005d18
mov eax, dword [0x100b4f4]
cmp eax, esi
je 0x1005d18
push eax
call fcn.01003bd5
pop ecx
call eax
mov dword [ebp - 4], eax
cmp eax, ebx
je 0x1005d18
mov eax, dword [0x100b4f8]
cmp eax, esi
je 0x1005d18
push dword [ebp - 4]
push eax
call fcn.01003bd5
pop ecx
call eax
mov dword [ebp - 4], eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
push dword [0x100b4f0]
call fcn.01003bd5
pop ecx
call eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x1008fd0
Capabilities:
Get system information on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x5c
mov eax, dword [0x100aa60]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
lea eax, [ebp - 0xc]
push edi
xor esi, esi
push eax
mov dword [ebp - 0xc], esi
call fcn.01002cef
pop ecx
test eax, eax
je 0x1009005
push esi
push esi
push esi
push esi
push esi
call fcn.01005179
add esp, 0x14
push 4
pop eax
call fcn.01009260
mov dword [ebp - 0x14], esp
push 0x1c
lea eax, [ebp - 0x38]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x1009121
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x5c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov edi, dword [ebp - 0xc]
mov ebx, dword [ebp - 0x58]
dec edi
neg edi
sbb edi, edi
and edi, 0x103
inc edi
cmp dword [ebp - 0xc], 2
mov dword [ebp - 8], esi
jne 0x100909a
mov dword [ebp - 0x10], esi
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push 0x10018d0
call esi
test eax, eax
jne 0x1009071
push 0x10018b4
call esi
test eax, eax
je 0x100909a
push 0x10024c8
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x100909a
and dword [ebp - 0x10], 0
lea ecx, [ebp - 0x10]
push ecx
call eax
cmp eax, 1
jne 0x100909a
mov eax, dword [ebp - 0x10]
test eax, eax
jbe 0x100909a
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
lea esi, [ebx - 1]
push esi
push dword [ebp - 8]
call fcn.010033ef
add esp, 0xc
test eax, eax
jl 0x1009121
not esi
and dword [ebp - 8], esi
je 0x10090cc
lea eax, [ebp - 8]
push eax
push ebx
push dword [ebp - 8]
call fcn.010033ef
add esp, 0xc
test eax, eax
jl 0x1009121
lea eax, [ebx + ebx]
cmp dword [ebp - 8], eax
jae 0x10090d7
mov dword [ebp - 8], eax
lea esi, [ebx - 1]
not esi
and esi, dword [ebp - 0x14]
sub esi, dword [ebp - 8]
cmp dword [ebp - 0xc], 1
jne 0x10090eb
push 0x11
pop ebx
mov eax, dword [ebp - 0x18]
add ebx, eax
cmp esi, ebx
jb 0x1009121
push 4
push 0x1000
push dword [ebp - 8]
push esi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
test eax, eax
je 0x1009121
lea eax, [ebp - 0x1c]
push eax
push edi
push dword [ebp - 8]
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x1009121
xor eax, eax
inc eax
jmp 0x1009123
xor eax, eax
lea esp, [ebp - 0x68]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.01006e1a
leave
ret
Function at 0x40a0d0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, 0x409015
lea edi, [esi - 0x8015]
push edi
jmp 0x40a0ea
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x40a0f1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x40a0e0
mov eax, 1
add ebx, ebx
jne 0x40a103
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x40a0f8
jne 0x40a114
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x40a0f8
xor ecx, ecx
sub eax, 3
jb 0x40a128
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x40a19a
mov ebp, eax
add ebx, ebx
jne 0x40a133
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x40a140
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x40a164
inc ecx
add ebx, ebx
jne 0x40a150
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x40a145
jne 0x40a161
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x40a145
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x40a184
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x40a175
jmp 0x40a0e6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x40a184
add edi, ecx
jmp 0x40a0e6
pop esi
lea edi, [esi + 0x8000]
mov eax, dword [edi]
or eax, eax
je 0x40a1ec
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xca00]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xcaa4]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x40a1a1
mov ecx, edi
jns 0x40a1d0
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xcaac]
or eax, eax
je 0x40a1e6
mov dword [ebx], eax
add ebx, 4
jmp 0x40a1be
call dword [esi + 0xcaa8]
mov ebp, dword [esi + 0xcab0]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x19f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x40a220
sub esp, 0xffffff80
jmp section.UPX0
Function at 0x414ac0
Capabilities:
Encode data using xor

Disassembly:
add eax, 0x94ccf628
adc byte [edi + esi*2], bl
int3
sbb al, 0x77
cmpsd dword [esi], dword es:[edi]
pop es
invalid
sal dword [ebp + 0x48d61bf], cl
test byte [esi - 0x2d], dh
add al, 0x84
jbe 0x41493f
sar dword [ebp + 0x4c561bb], cl
mov ebp, 0x4c561bb
add al, 0x84
jbe 0x414945
test byte [esi - 0x2f], dh
sar dword [edx], 1
invalid
cmp dh, al
int3
jae 0x4149b0
dec ebp
mov al, 0x38
xchg dword [esi - 0x59], esi
jae 0x4149c0
dec ecx
mov al, pe_nt_image_headers32
xchg dword [esi - 0x59], esi
jno 0x414942
add bl, byte [0xa4e79338]
out 0xa4, eax
pop es
test byte [edx], al
or ebp, esp
invalid
jne 0x414a19
mov edx, ebx
lodsd eax, dword [esi]
xchg dword [edx + ecx*4], ecx
invalid
add al, 0x52
pop ecx
aad 0xb0
jp 0x41498e
mov al, 0x7a
jecxz 0x4149fe
push edx
jae 0x4149ec
dec ecx
shr dword [ebp + 0x4e16187], cl
test byte [esi - 0x50], dh
lodsd eax, dword [esi]
xchg dword [ecx - 0x1f], esp
add al, 0x84
jbe 0x414968
pop esp
inc esi
jbe 0x414963
jne 0x4149fc
inc ebp
mov al, 0xb4
wait
mov ah, 0x9b
ja 0x41496b
jne 0x414a04
pop ecx
mov al, 0xbc
wait
ja 0x414973
mov esp, 0x75a7779b
jne 0x414980
jne 0x414a0c
jne 0x414980
les ebx, [ebx - 0x15f5889]
dec ecx
sub al, 0xfd
mov al, byte [0xfd2c49fe]
std
xchg ebx, eax
cmp esp, dword [esi + 7]
test dh, dl
push es
mov dword [0xf8584ab2], eax
jnp 0x414970
pop eax
clc
jnp 0x414974
pop eax
clc
jnp 0x414978
pop eax
lodsd eax, dword [esi]
repne insb byte es:[edi], dx
fcmovnb st(0), st(5)
jnp 0x4149e0
lds edi, [ebx - 0x17]
sbb eax, edi
clc
jnp 0x4149f8
dec ebp
pop es
dec esi
mov dword [eax], edi
mov ecx, 0x3f51617b
aas
test dword [esi - 0x61], esi
std
jnp 0x4149f4
sbb eax, edi
clc
jnp 0x414998
pop eax
clc
mov dl, 0x4a
pop eax
clc
jnp 0x4149a0
pop eax
clc
jnp 0x4149a4
pop eax
clc
jnp 0x4149a8
pop eax
adc byte [eax - 0x47f8588a], dh
mov dword [eax - 8], ebx
clc
jnp 0x4149b4
pop eax
clc
jnp 0x4149b8
pop eax
cmp edi, dword [ebx - 0x77]
pop eax
clc
jnp 0x4149c0
pop eax
clc
jnp 0x4149c4
pop eax
clc
jnp 0x4149c8
pop eax
cmp edi, dword [ebx - 0x77]
pop eax
clc
jnp 0x4149d0
pop eax
clc
jnp 0x4149d4
pop eax
clc
jnp 0x4149d8
pop eax
pop eax
or ebx, ecx
sbb eax, edi
fldcw word [ecx + 0x4a7bb938]
pop eax
clc
jnp 0x4149e8
pop eax
lodsd eax, dword [esi]
repne insb byte es:[edi], dx
sar dword [ebp - 0xbe2fd8d], cl
invalid
cmpsd dword [esi], dword es:[edi]
inc eax
jnp 0x414a28
pop eax
stc
xchg ebx, eax
mov dword [0x62840707], eax
dec esp
pop es
dec esi
fld dword [ecx]
mov ecx, 0x3f65617b
test dword [esi - 0x23], esi
cmp byte [edi], cl
invalid
lodsd eax, dword [esi]
repne insb byte es:[edi], dx
sahf
std
stosd dword es:[edi], eax
fcomp dword [ecx]
clc
jp 0x414aac
mov byte [edx], bh
cmp dword [ecx - 0xc6cf1ce], ecx
popfd
push es
test cl, bl
mov al, 0x5c
mov ebp, 0x7b41a777
imul ebx, dword [edx], 0xb88dc1f8
mov edx, 0x9868317b
cmp cl, byte [ecx + 0x7684a8b0]
cmpsd dword [esi], dword es:[edi]
adc byte [eax], ah
jbe 0x414a9b
pop es
ret