joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41bfa0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
mov ecx, dword [ebp - 8]
add ecx, 0x48
call dword [sym.imp.GrphCalc.dll_public:_void___thiscall_CDPoint::constructor_void_]
push 0x41bf60
push 4
push 0x4c
mov eax, dword [ebp - 8]
add eax, 0xa4
push eax
call fcn.0041c140
mov dword [ebp - 4], 0
jmp 0x41bfde
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
cmp dword [ebp - 4], 4
jge 0x41bff3
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 8]
mov dword [eax + edx*4], 0xffffffff
jmp 0x41bfd5
mov ecx, dword [ebp - 8]
mov dword [ecx + 0x10], 0
mov edx, dword [ebp - 8]
mov dword [edx + 0x9c], 0
mov dword [edx + 0xa0], 0xc0c38800
mov eax, dword [ebp - 8]
mov dword [eax + 0x18], 0
mov ecx, dword [ebp - 8]
mov dword [ecx + 0x1c], 0
mov edx, dword [ebp - 8]
mov dword [edx + 0x20], 0
mov dword [edx + 0x24], 0
mov eax, dword [ebp - 8]
mov dword [eax + 0x28], 0
mov dword [eax + 0x2c], 0
mov ecx, dword [ebp - 8]
mov dword [ecx + 0x30], 0
mov dword [ecx + 0x34], 0
mov edx, dword [ebp - 8]
mov dword [edx + 0x38], 0
mov dword [edx + 0x3c], 0
mov eax, dword [ebp - 8]
mov dword [eax + 0x40], 0
mov dword [eax + 0x44], 0
mov ecx, dword [ebp - 8]
mov dword [ecx + 0x58], 0
mov dword [ecx + 0x5c], 0
mov edx, dword [ebp - 8]
mov dword [edx + 0x60], 0
mov dword [edx + 0x64], 0
mov eax, dword [ebp - 8]
mov dword [eax + 0x68], 0
mov dword [eax + 0x6c], 0
mov ecx, dword [ebp - 8]
mov dword [ecx + 0x70], 0
mov edx, dword [ebp - 8]
mov dword [edx + 0x74], 0
mov eax, dword [ebp - 8]
mov dword [eax + 0x78], 0
mov ecx, dword [ebp - 8]
mov dword [ecx + 0x7c], 0
mov edx, dword [ebp - 8]
mov dword [edx + 0x80], 0
mov eax, dword [ebp - 8]
mov dword [eax + 0x84], 0
mov ecx, dword [ebp - 8]
mov dword [ecx + 0x88], 0
mov edx, dword [ebp - 8]
mov dword [edx + 0x8c], 0
mov dword [edx + 0x90], 0
mov eax, dword [ebp - 8]
mov dword [eax + 0x94], 0
mov dword [eax + 0x98], 0
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
Function at 0x420c24
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4740fc
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x15c
cmp dword [0x497468], 1
je 0x420da4
push 0xa0
lea eax, [ebp - 0x15c]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea ecx, [ebp - 0x160]
call sub.MFC42.DLL_CString::CString_1
mov dword [ebp - 4], 0
push 0x18
lea ecx, [ebp - 0x160]
call sub.MFC42.DLL_CString::LoadStringA
mov ecx, dword [ebp - 0x160]
push ecx
push 0x489c44
lea edx, [ebp - 0xbc]
push edx
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push 0x489c48
lea eax, [ebp - 0x15c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea ecx, [ebp - 0xbc]
push ecx
lea edx, [ebp - 0x15c]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push 0x4000
lea eax, [ebp - 0x94]
push eax
lea ecx, [ebp - 0x15c]
push ecx
call dword [sym.imp.KERNEL32.dll_OpenFile]
cmp eax, 0xffffffff
je 0x420d92
lea edx, [ebp - 0x15c]
push edx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [0x49746c], eax
cmp dword [0x49746c], 0
jne 0x420d10
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x164], eax
jmp 0x420d92
push str.DSM_Entry
mov eax, dword [0x49746c]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x497320], eax
cmp dword [0x497320], 0
jne 0x420d3d
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x164], eax
jmp 0x420d92
push 0x497464
push 0x301
push 4
push 1
push 0
push 0x4973c8
call dword [0x497320]
mov word [ebp - 0x98], ax
mov ecx, dword [ebp - 0x98]
and ecx, 0xffff
mov dword [ebp - 0x168], ecx
cmp dword [ebp - 0x168], 0
je 0x420d7c
jmp 0x420d88
mov dword [0x497468], 1
jmp 0x420d92
mov dword [0x497468], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x160]
call sub.MFC42.DLL_CString::CString
mov eax, dword [0x497468]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x44205a
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov eax, dword fs:[0x30]
movzx eax, byte [eax + 2]
or al, al
je 0x442075
mov eax, 1
jmp 0x442077
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x46a7b0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x68
push esi
push edi
mov ecx, 0x10
xor eax, eax
lea edi, [esp + 0x30]
mov byte [esp + 0x2c], 0xb
mov byte [esp + 0x2d], 0xcd
mov byte [esp + 0x2e], 0
mov byte [esp + 0x2f], 0x10
push eax
rep stosd dword es:[edi], eax
call sub.MSVCRT.dll_time
push eax
call sub.MSVCRT.dll_srand
add esp, 8
xor esi, esi
call sub.MSVCRT.dll_rand
mov dword [esp + 8], eax
fild dword [esp + 8]
fmul qword [0x4809b8]
call sub.MSVCRT.dll__ftol
mov byte [esp + esi + 0xc], al
inc esi
cmp esi, 0x10
jl 0x46a7e7
mov al, byte [esp + 0xd]
mov esi, dword [esp + 0x74]
and al, 0x7f
mov byte [esp + 0xd], al
mov eax, dword [esp + 0xc]
mov dword [esi + 0x10], eax
xor eax, eax
mov cl, byte [eax + str.p_NMs]
xor cl, 0x5b
mov byte [esp + eax + 0x1c], cl
inc eax
cmp eax, 0x10
jl 0x46a820
lea edx, [esp + 0x1c]
push edx
call fcn.0046bd50
lea eax, [esp + 0x10]
push eax
call fcn.0046b3b0
mov edx, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x3c], edx
lea edx, [esp + 0x34]
mov dword [esp + 0x38], ecx
mov ecx, dword [esp + 0x20]
push edx
push esi
mov dword [esp + 0x48], eax
mov dword [esp + 0x4c], ecx
call fcn.0046a880
add esp, 0x10
pop edi
pop esi
add esp, 0x68
ret
Function at 0x46a9c0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push ebp
push esi
push edi
push 0
call sub.MSVCRT.dll_time
push eax
call sub.MSVCRT.dll_srand
mov ebx, dword [esp + 0x20]
xor eax, eax
add esp, 8
mov al, byte [ebx + 3]
mov esi, eax
cmp esi, 0x40
jge 0x46aa06
call sub.MSVCRT.dll_rand
mov dword [esp + 0x18], eax
fild dword [esp + 0x18]
fmul qword [0x4809b8]
call sub.MSVCRT.dll__ftol
mov byte [ebx + esi + 4], al
inc esi
cmp esi, 0x40
jl 0x46a9e4
mov esi, dword [esp + 0x14]
lea eax, [ebx + 2]
mov ecx, 0x11
lea edi, [esi + 0x10]
mov dl, byte [edi]
xor byte [eax - 2], dl
mov dl, byte [esi + 0x11]
xor byte [eax - 1], dl
mov dl, byte [esi + 0x12]
xor byte [eax], dl
mov dl, byte [esi + 0x13]
xor byte [eax + 1], dl
add eax, 4
dec ecx
jne 0x46aa15
mov eax, dword [esi + 8]
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
xor eax, eax
je 0x46aa52
cmp eax, 0x80
je 0x46aa52
pop edi
pop esi
pop ebp
mov eax, 0xe
pop ebx
ret
mov ecx, dword [esi + 0xc]
push 0x44
push ebx
push ecx
call fcn.0046b220
xor eax, eax
add esp, 0xc
xor ebp, ebp
je 0x46aa78
mov edx, dword [esi + 8]
push edx
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
ret
mov eax, dword [esi + 8]
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
xor ecx, ecx
xor edx, edx
mov cl, byte [esi + 0x13]
mov dl, byte [ebx + 3]
xor ecx, edx
mov eax, ecx
mov ebp, ecx
cdq
and edx, 3
add eax, edx
sar eax, 2
inc eax
and ebp, 0x80000003
jns 0x46aaa9
dec ebp
or ebp, 0xfffffffc
inc ebp
test eax, eax
jle 0x46aad8
lea ecx, [ebx + 2]
mov dword [esp + 0x18], eax
mov dl, byte [edi]
xor byte [ecx - 2], dl
mov dl, byte [esi + 0x11]
xor byte [ecx - 1], dl
mov dl, byte [esi + 0x12]
xor byte [ecx], dl
mov dl, byte [esi + 0x13]
xor byte [ecx + 1], dl
mov edx, dword [esp + 0x18]
add ecx, 4
dec edx
mov dword [esp + 0x18], edx
jne 0x46aab4
test ebp, ebp
jle 0x46aaec
lea eax, [ebx + eax*4]
mov cl, byte [edi]
mov dl, byte [eax]
xor dl, cl
inc edi
mov byte [eax], dl
inc eax
dec ebp
jne 0x46aadf
xor eax, eax
pop edi
mov byte [ebx], al
pop esi
pop ebp
pop ebx
ret
Function at 0x46bab0
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
push ebx
mov cl, byte [eax]
mov dl, byte [ecx + 0x480ac0]
mov ecx, dword [esp + 0xc]
xor dl, byte [ecx]
mov byte [eax], dl
mov bl, byte [ecx + 1]
xor edx, edx
mov dl, byte [eax + 1]
mov dl, byte [edx + 0x480ac0]
xor dl, bl
mov byte [eax + 1], dl
mov bl, byte [ecx + 2]
xor edx, edx
mov dl, byte [eax + 2]
mov dl, byte [edx + 0x480ac0]
xor dl, bl
mov byte [eax + 2], dl
mov bl, byte [ecx + 3]
xor edx, edx
mov dl, byte [eax + 3]
mov dl, byte [edx + 0x480ac0]
xor dl, bl
mov byte [eax + 3], dl
mov bl, byte [ecx + 4]
xor edx, edx
mov dl, byte [eax + 4]
mov dl, byte [edx + 0x480ac0]
xor dl, bl
mov byte [eax + 4], dl
mov bl, byte [ecx + 5]
xor edx, edx
mov dl, byte [eax + 5]
mov dl, byte [edx + 0x480ac0]
xor dl, bl
mov byte [eax + 5], dl
mov bl, byte [ecx + 6]
xor edx, edx
mov dl, byte [eax + 6]
mov dl, byte [edx + 0x480ac0]
xor dl, bl
mov byte [eax + 6], dl
mov bl, byte [ecx + 7]
xor edx, edx
mov dl, byte [eax + 7]
mov dl, byte [edx + 0x480ac0]
xor dl, bl
mov byte [eax + 7], dl
mov bl, byte [ecx + 8]
xor edx, edx
mov dl, byte [eax + 8]
mov dl, byte [edx + 0x480ac0]
xor dl, bl
mov byte [eax + 8], dl
mov bl, byte [ecx + 9]
xor edx, edx
mov dl, byte [eax + 9]
mov dl, byte [edx + 0x480ac0]
xor dl, bl
mov byte [eax + 9], dl
mov bl, byte [ecx + 0xa]
xor edx, edx
mov dl, byte [eax + 0xa]
mov dl, byte [edx + 0x480ac0]
xor dl, bl
mov byte [eax + 0xa], dl
mov bl, byte [ecx + 0xb]
xor edx, edx
mov dl, byte [eax + 0xb]
mov dl, byte [edx + 0x480ac0]
xor dl, bl
mov byte [eax + 0xb], dl
mov bl, byte [ecx + 0xc]
xor edx, edx
mov dl, byte [eax + 0xc]
mov dl, byte [edx + 0x480ac0]
xor dl, bl
mov byte [eax + 0xc], dl
mov bl, byte [ecx + 0xd]
xor edx, edx
mov dl, byte [eax + 0xd]
mov dl, byte [edx + 0x480ac0]
xor dl, bl
mov byte [eax + 0xd], dl
mov bl, byte [ecx + 0xe]
xor edx, edx
mov dl, byte [eax + 0xe]
mov dl, byte [edx + 0x480ac0]
xor dl, bl
mov byte [eax + 0xe], dl
mov bl, byte [ecx + 0xf]
xor edx, edx
mov dl, byte [eax + 0xf]
mov dl, byte [edx + 0x480ac0]
xor dl, bl
pop ebx
mov byte [eax + 0xf], dl
ret
Function at 0x46bc40
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
sub esp, 8
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0xc]
push ebx
push ebp
mov dx, word [ecx]
push esi
mov word [eax], dx
mov dx, word [ecx + 2]
mov word [eax + 2], dx
mov dx, word [ecx + 4]
mov word [eax + 4], dx
mov dx, word [ecx + 6]
mov word [eax + 6], dx
mov dx, word [ecx + 8]
mov word [eax + 8], dx
mov dx, word [ecx + 0xa]
mov word [eax + 0xa], dx
mov dx, word [ecx + 0xc]
mov word [eax + 0xc], dx
mov cx, word [ecx + 0xe]
push edi
mov word [eax + 0xe], cx
mov esi, 0x48b72c
mov word [esp + 0x10], dx
mov word [esp + 0x12], cx
add eax, 0x10
mov edi, 0x10
mov ebx, 0x28
mov ebp, edi
and ebp, 0x8000000f
jns 0x46bcb8
dec ebp
or ebp, 0xfffffff0
inc ebp
jne 0x46bd22
mov edx, dword [esp + 0x11]
mov cl, byte [esp + 0x10]
and edx, 0xff
mov byte [esp + 0x20], cl
mov cl, byte [edx + 0x4809c0]
mov edx, dword [esp + 0x12]
and edx, 0xff
mov byte [esp + 0x10], cl
mov cl, byte [edx + 0x4809c0]
mov edx, dword [esp + 0x13]
and edx, 0xff
mov byte [esp + 0x11], cl
mov cl, byte [edx + 0x4809c0]
mov edx, dword [esp + 0x20]
and edx, 0xff
mov byte [esp + 0x12], cl
mov cl, byte [edx + 0x4809c0]
mov dx, word [esp + 0x10]
xor dx, word [esi]
mov byte [esp + 0x13], cl
mov cx, word [esp + 0x12]
add esi, 2
xor dx, word [eax - 0x10]
xor cx, word [eax - 0xe]
add edi, 4
mov word [eax], dx
mov word [eax + 2], cx
add eax, 4
dec ebx
mov word [esp + 0x10], dx
mov word [esp + 0x12], cx
jne 0x46bca9
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
Function at 0x4702d0
Capabilities:
Get disk information

Disassembly:
push ecx
mov eax, dword [esp + 8]
push ebx
push ebp
push esi
push edi
push eax
xor ebp, ebp
call fcn.004704b0
add esp, 4
mov dword [esp + 0x10], eax
test eax, eax
jne 0x4702f8
mov ecx, dword [esp + 0x20]
pop edi
pop esi
pop ebp
mov dword [ecx], eax
pop ebx
pop ecx
ret
mov ebx, dword [esp + 0x20]
mov edx, dword [ebx]
lea eax, [edx*4 + 4]
push eax
call sub.MSVCRT.dll_malloc
mov esi, dword [esp + 0x20]
mov edi, eax
add esp, 4
test edi, edi
mov dword [esi], edi
jne 0x470322
pop edi
pop esi
mov dword [ebx], eax
pop ebp
pop ebx
pop ecx
ret
mov ecx, dword [ebx]
xor eax, eax
push 0x8000
lea ecx, [ecx*4 + 4]
mov edx, ecx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
call sub.MSVCRT.dll_malloc
add esp, 4
mov ebx, eax
mov ecx, 0x2000
xor eax, eax
mov edi, ebx
push 0x8000
push ebx
push eax
rep stosd dword es:[edi], eax
mov dword [esp + 0x24], ebx
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceA]
test eax, eax
jne 0x470385
mov eax, dword [esp + 0x20]
push ebx
mov dword [eax], 0
call sub.MSVCRT.dll_free
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
mov eax, dword [esp + 0x18]
lea ecx, [eax + 0x8000]
cmp eax, ecx
jae 0x47048b
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x470487
mov edx, dword [esp + 0x10]
or ecx, 0xffffffff
mov edi, edx
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push ebx
push edx
call fcn.00472750
add esp, 0xc
test eax, eax
jne 0x470466
mov edi, ebx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
add ecx, 8
push ecx
call sub.MSVCRT.dll_malloc
mov ecx, dword [esi]
mov edi, ebx
add esp, 4
mov dword [ecx + ebp*4], eax
or ecx, 0xffffffff
xor eax, eax
mov edx, dword [esi]
repne scasb al, byte es:[edi]
mov edi, dword [edx + ebp*4]
not ecx
add ecx, 3
mov edx, ecx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
mov eax, dword [esi]
mov edi, ebx
not ecx
mov edx, dword [eax + ebp*4]
add ecx, 3
mov dword [edx], ecx
mov eax, dword [esi]
mov edx, dword [str.._]
mov ecx, dword [eax + ebp*4]
add ecx, 4
mov dword [ecx], edx
mov al, byte [0x496ef0]
mov byte [ecx + 4], al
mov ecx, dword [esi]
xor eax, eax
mov edx, dword [ecx + ebp*4]
or ecx, 0xffffffff
add edx, 4
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
inc ebp
rep movsb byte es:[edi], byte [esi]
mov esi, dword [esp + 0x1c]
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
mov eax, dword [esp + 0x18]
not ecx
dec ecx
add eax, 0x8000
lea ebx, [ebx + ecx + 1]
cmp ebx, eax
jb 0x470397
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x20]
push eax
mov dword [ecx], ebp
call sub.MSVCRT.dll_free
add esp, 4
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x470fe9
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
lea eax, [ebp - 4]
push esi
xor esi, esi
push eax
push 0x20019
push esi
push str.CLSIDADB880A6_D8FF_11CF_9377_00AA003B7A11InprocServer32
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x471041
lea eax, [ebp - 8]
mov dword [ebp - 8], 0x104
push eax
push dword [ebp + 8]
push esi
push esi
push 0x497684
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x471034
push 1
pop esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0x471043
xor eax, eax
pop esi
leave
ret 4
Function at 0x4e8c53
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [ebp + 8]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0x18], ecx
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
add eax, dword [edx + 0x3c]
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x24]
add ecx, 0xf8
mov dword [ebp - 0x14], ecx
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x1c]
add eax, dword [edx + 0x78]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 0x1c]
add edx, dword [ecx + 0x20]
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x1c]
add ecx, dword [eax + 0x24]
mov dword [ebp - 0x20], ecx
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0x1c]
add eax, dword [edx + 0x1c]
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], 0
jmp 0x4e8cbf
mov ecx, dword [ebp - 0xc]
add ecx, 1
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
cmp eax, dword [edx + 0x18]
jae 0x4e8d08
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x1c]
add eax, dword [edx + ecx*4]
mov dword [ebp - 0x28], eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp - 0x28]
push edx
call fcn.00502100
add esp, 8
test eax, eax
jne 0x4e8d06
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x20]
xor edx, edx
mov dx, word [ecx + eax*2]
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x1c]
add ecx, dword [eax + edx*4]
mov eax, ecx
jmp 0x4e8d0a
jmp 0x4e8cb6
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x4f4f9a
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0xc], 0
jne 0x4f4faa
xor eax, eax
jmp 0x4f5173
mov eax, dword [ebp + 8]
xor eax, 0xffffffff
mov dword [ebp + 8], eax
cmp dword [ebp + 0x10], 8
jb 0x4f512b
mov ecx, dword [ebp + 0xc]
xor edx, edx
mov dl, byte [ecx]
mov eax, dword [ebp + 8]
xor eax, edx
and eax, 0xff
mov ecx, dword [ebp + 8]
shr ecx, 8
mov edx, dword [eax*4 + 0x525eac]
xor edx, ecx
mov dword [ebp + 8], edx
mov eax, dword [ebp + 0xc]
add eax, 1
mov dword [ebp + 0xc], eax
mov ecx, dword [ebp + 0xc]
xor edx, edx
mov dl, byte [ecx]
mov eax, dword [ebp + 8]
xor eax, edx
and eax, 0xff
mov ecx, dword [ebp + 8]
shr ecx, 8
mov edx, dword [eax*4 + 0x525eac]
xor edx, ecx
mov dword [ebp + 8], edx
mov eax, dword [ebp + 0xc]
add eax, 1
mov dword [ebp + 0xc], eax
mov ecx, dword [ebp + 0xc]
xor edx, edx
mov dl, byte [ecx]
mov eax, dword [ebp + 8]
xor eax, edx
and eax, 0xff
mov ecx, dword [ebp + 8]
shr ecx, 8
mov edx, dword [eax*4 + 0x525eac]
xor edx, ecx
mov dword [ebp + 8], edx
mov eax, dword [ebp + 0xc]
add eax, 1
mov dword [ebp + 0xc], eax
mov ecx, dword [ebp + 0xc]
xor edx, edx
mov dl, byte [ecx]
mov eax, dword [ebp + 8]
xor eax, edx
and eax, 0xff
mov ecx, dword [ebp + 8]
shr ecx, 8
mov edx, dword [eax*4 + 0x525eac]
xor edx, ecx
mov dword [ebp + 8], edx
mov eax, dword [ebp + 0xc]
add eax, 1
mov dword [ebp + 0xc], eax
mov ecx, dword [ebp + 0xc]
xor edx, edx
mov dl, byte [ecx]
mov eax, dword [ebp + 8]
xor eax, edx
and eax, 0xff
mov ecx, dword [ebp + 8]
shr ecx, 8
mov edx, dword [eax*4 + 0x525eac]
xor edx, ecx
mov dword [ebp + 8], edx
mov eax, dword [ebp + 0xc]
add eax, 1
mov dword [ebp + 0xc], eax
mov ecx, dword [ebp + 0xc]
xor edx, edx
mov dl, byte [ecx]
mov eax, dword [ebp + 8]
xor eax, edx
and eax, 0xff
mov ecx, dword [ebp + 8]
shr ecx, 8
mov edx, dword [eax*4 + 0x525eac]
xor edx, ecx
mov dword [ebp + 8], edx
mov eax, dword [ebp + 0xc]
add eax, 1
mov dword [ebp + 0xc], eax
mov ecx, dword [ebp + 0xc]
xor edx, edx
mov dl, byte [ecx]
mov eax, dword [ebp + 8]
xor eax, edx
and eax, 0xff
mov ecx, dword [ebp + 8]
shr ecx, 8
mov edx, dword [eax*4 + 0x525eac]
xor edx, ecx
mov dword [ebp + 8], edx
mov eax, dword [ebp + 0xc]
add eax, 1
mov dword [ebp + 0xc], eax
mov ecx, dword [ebp + 0xc]
xor edx, edx
mov dl, byte [ecx]
mov eax, dword [ebp + 8]
xor eax, edx
and eax, 0xff
mov ecx, dword [ebp + 8]
shr ecx, 8
mov edx, dword [eax*4 + 0x525eac]
xor edx, ecx
mov dword [ebp + 8], edx
mov eax, dword [ebp + 0xc]
add eax, 1
mov dword [ebp + 0xc], eax
mov ecx, dword [ebp + 0x10]
sub ecx, 8
mov dword [ebp + 0x10], ecx
jmp 0x4f4fb3
cmp dword [ebp + 0x10], 0
je 0x4f516d
mov edx, dword [ebp + 0xc]
xor eax, eax
mov al, byte [edx]
mov ecx, dword [ebp + 8]
xor ecx, eax
and ecx, 0xff
mov edx, dword [ebp + 8]
shr edx, 8
mov eax, dword [ecx*4 + 0x525eac]
xor eax, edx
mov dword [ebp + 8], eax
mov ecx, dword [ebp + 0xc]
add ecx, 1
mov dword [ebp + 0xc], ecx
mov edx, dword [ebp + 0x10]
sub edx, 1
mov dword [ebp + 0x10], edx
cmp dword [ebp + 0x10], 0
jne 0x4f5131
mov eax, dword [ebp + 8]
xor eax, 0xffffffff
pop ebp
ret
Function at 0x5cb359
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x50
push ebp
lea eax, [esp + 0x28]
push edi
push eax
call fcn.005cb509
mov ecx, dword [esp + 0x5c]
xor edx, edx
xor ebp, ebp
mov dword [esp + 0xc], 1
mov edi, dword [ecx]
mov dword [esp + 0x10], 8
mov dword [esp + 0x14], 2
mov dword [esp + 0x18], 4
mov dx, word [edi + 0x14]
cmp word [edi + 6], bp
mov dword [esp + 0x1c], 0x10
mov dword [esp + 0x20], 0x80
mov dword [esp + 0x24], 0x20
mov dword [esp + 0x28], 0x40
lea eax, [edx + edi + 0x18]
jbe 0x5cb457
push ebx
push esi
lea ebx, [eax + 0x24]
mov eax, dword [ebx]
mov ecx, eax
mov edx, eax
shr ecx, 0x1d
shr edx, 0x1e
mov esi, eax
and ecx, 1
and edx, 1
shr esi, 0x1f
test eax, 0x2000000
je 0x5cb3fa
mov eax, dword [ebx - 0x14]
mov ecx, dword [ebx - 0x1c]
push 0x4000
push eax
push ecx
call dword [esp + 0x4c]
jmp 0x5cb43d
lea edx, [edx + ecx*2]
test eax, 0x4000000
lea ecx, [esi + edx*2]
mov esi, dword [esp + ecx*4 + 0x14]
je 0x5cb411
or esi, 0x200
mov edx, dword [ebx - 0x14]
mov ecx, edx
test ecx, ecx
jne 0x5cb42c
test al, 0x40
je 0x5cb423
mov ecx, dword [edi + 0x20]
jmp 0x5cb42a
test al, 0x80
je 0x5cb43d
mov ecx, dword [edi + 0x24]
test ecx, ecx
jbe 0x5cb43d
mov ecx, dword [ebx - 0x1c]
lea eax, [esp + 0x10]
push eax
push esi
push edx
push ecx
call dword [esp + 0x44]
mov edx, dword [esp + 0x64]
xor eax, eax
inc ebp
add ebx, 0x28
mov edi, dword [edx]
mov ax, word [edi + 6]
cmp ebp, eax
jl 0x5cb3c9
pop esi
pop ebx
pop edi
pop ebp
add esp, 0x50
ret
Function at 0x526100
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0xd6000]
push edi
or ebp, 0xffffffff
jmp 0x526122
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x526129
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x526118
mov eax, 1
add ebx, ebx
jne 0x52613b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x52614c
jne 0x52615c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x52615c
dec eax
add ebx, ebx
jne 0x526158
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x526130
xor ecx, ecx
sub eax, 3
jb 0x526174
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x5261e6
sar eax, 1
mov ebp, eax
jmp 0x52617f
add ebx, ebx
jne 0x52617f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x52618c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x5261b0
inc ecx
add ebx, ebx
jne 0x52619c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x526191
jne 0x5261ad
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x526191
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x5261d0
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x5261c1
jmp 0x52611e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x5261d0
add edi, ecx
jmp 0x52611e
pop esi
mov edi, esi
mov ecx, 0x2ab
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x5261ee
cmp byte [edi], 6
jne 0x5261ee
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov eax, ebx
loop 0x5261f3
lea edi, [esi + 0x124000]
mov eax, dword [edi]
or eax, eax
je 0x526262
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x12bd94]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x12bde4]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x526220
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x12bde8]
or eax, eax
je 0x52625c
mov dword [ebx], eax
add ebx, 4
jmp 0x52623d
call dword [esi + 0x12bdec]
popal
jmp 0x4036b9
Function at 0x422abf
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
push ebx
xor eax, eax
mov ebx, dword fs:[0x18]
mov ecx, dword fs:[0x30]
test ecx, ecx
jns 0x422af7
mov ecx, 0x530000
cmp dword [ebx + 0x58], ecx
jne 0x422ae5
mov al, 1
jmp 0x422b41
cmp dword [ebx + 0x54], ecx
jne 0x422aee
mov al, 2
jmp 0x422b41
cmp dword [ebx + 0x7c], ecx
jne 0x422b41
mov al, 3
jmp 0x422b41
mov ebx, dword [ecx + 0xa8]
mov ecx, dword [ecx + 0xa4]
cmp ecx, 4
ja 0x422b0c
mov al, 4
jmp 0x422b41
cmp ecx, 5
jne 0x422b2c
cmp ebx, 0
jne 0x422b1a
mov al, 5
jmp 0x422b41
cmp ebx, 1
jne 0x422b23
mov al, 6
jmp 0x422b41
cmp ebx, 2
jne 0x422b2c
mov al, 7
jmp 0x422b41
cmp ecx, 6
jne 0x422b38
cmp ebx, 0
jne 0x422b3a
mov al, 8
jmp 0x422b41
cmp ebx, 1
jne 0x422b41
mov al, 9
pop ebx
mov esp, ebp
pop ebp
ret