joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401cca
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
xor ebx, ebx
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_InitializeAcl]
mov esi, ebx
push ebx
push ebx
push ebx
call edi
xor byte [esi + section..BSS], 0x80
push ebx
push ebx
push ebx
call edi
add byte [esi + section..BSS], 0xd2
push ebx
push ebx
push ebx
call edi
add byte [esi + section..BSS], 0xa7
push ebx
push ebx
push ebx
call edi
xor byte [esi + section..BSS], 0xaf
push ebx
push ebx
push ebx
call edi
add byte [esi + section..BSS], 0x25
push ebx
push ebx
push ebx
call edi
add byte [esi + section..BSS], 0xb9
push ebx
push ebx
push ebx
call edi
xor byte [esi + section..BSS], 0x72
push ebx
push ebx
push ebx
call edi
add byte [esi + section..BSS], 0x5f
push ebx
push ebx
push ebx
call edi
add byte [esi + section..BSS], 0x33
push ebx
push ebx
push ebx
call edi
xor byte [esi + section..BSS], 0x1b
push ebx
push ebx
push ebx
call edi
add byte [esi + section..BSS], 0x35
push ebx
push ebx
push ebx
call edi
add byte [esi + section..BSS], 0x9b
push ebx
push ebx
push ebx
call edi
add byte [esi + section..BSS], 0xbd
push ebx
push ebx
push ebx
call edi
xor byte [esi + section..BSS], 0x17
push ebx
push ebx
push ebx
call edi
xor byte [esi + section..BSS], 0xb4
push ebx
push ebx
push ebx
call edi
add byte [esi + section..BSS], 0x30
push ebx
push ebx
push ebx
call edi
add byte [esi + section..BSS], 0x1e
push ebx
push ebx
push ebx
call edi
add byte [esi + section..BSS], 0x81
push ebx
push ebx
push ebx
call edi
add byte [esi + section..BSS], 0xde
push ebx
push ebx
push ebx
call edi
xor byte [esi + section..BSS], 0xa9
push ebx
push ebx
push ebx
call edi
add byte [esi + section..BSS], 0x9e
push ebx
push ebx
push ebx
call edi
add byte [esi + section..BSS], 0xf5
push ebx
push ebx
push ebx
call edi
add byte [esi + section..BSS], 0xa2
push ebx
push ebx
push ebx
call edi
add byte [esi + section..BSS], 0xcf
push ebx
push ebx
push ebx
call edi
add byte [esi + section..BSS], 0x63
push ebx
push ebx
push ebx
call edi
add byte [esi + section..BSS], 0xb2
push ebx
push ebx
push ebx
call edi
xor byte [esi + section..BSS], 0x6d
push ebx
push ebx
push ebx
call edi
add byte [esi + section..BSS], 0x52
push ebx
push ebx
push ebx
call edi
add byte [esi + section..BSS], 0x14
inc esi
cmp esi, 0x2d200
jb 0x401cd7
pop edi
pop esi
pop ebx
ret
Function at 0x44dde6
Capabilities:
Parse pe header

Disassembly:
jmp 0x47df8b
lea esp, [esp + 4]
jmp fcn.0047e005

Function at 0x474ae0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
jmp 0x474b9d
xor edi, edi
cmp eax, edi
jne 0x474dcd
call fcn.00464285
add byte [esi + 0x58], bh
call fcn.00464292
add al, ch
pop es
cli
invalid
call fcn.0044ac7f
jmp 0x474bc5
mov eax, dword [ebp + 0xc]
push esi
push edi
cmp eax, 1
jne 0x474b48
push eax
call fcn.0044b9e4
pop ecx
test eax, eax
jne 0x474b7f
xor eax, eax
jmp 0x474c68
test eax, eax
jne 0x474bed
call fcn.0044ba14
jmp 0x474bb2
call fcn.0044b998
jmp 0x474c2b
call 0x4473b6
add byte [ecx + 0x4488e005], cl
add al, ch
and eax, 0xe8fffd6c
in ax, dx
invalid
cmp eax, 2
jne 0x475077
call 0x44a8f7
jmp 0x47592e
and al, byte [ebp - 0x4c]
pop edx
call 0x6edb4429
mov ch, bh
pushal
not byte [ecx - 0x5897da0]
push 0x3813fa0f
mov ebx, 0x4fbd4e2b
xchg ecx, eax
pushal
xor byte [esi - 6], 0x68
psubd mm2, qword [ebx]
cmp byte [ebx + 0x4fbd4e2b], bh
stc
imul edi, ecx, 0xa1816b98
xor ah, byte [eax - 0x4238cd39]
mov al, byte [0xbdc732c7]
xor esp, dword [ebx - 0x46bca3a]
push 0xfffffffffffffff8
lahf
push 0xffffffffffffffa9
add al, 0x92
add byte [edi - 0x6e], ah
jo 0x474fba
push edx
shl byte [edi + 0x57c5b852], 0xc7
mov byte [0xb227b751], al
and byte [edi - 0x4e], al
adc eax, 0x2849d941
fld xword [eax]
salc
push ebx
ret
stosb byte es:[edi], al
adc eax, 0x3b5cce50
salc
jg 0x474fde
mov ah, 0xd3
cdq
pop esp
rcl byte [esi + 0x31], 0xc0
xor eax, eax
imul edi, dword [ebx + 0x2ed3b426], 0x2cbe1c99
dec ebx
mov byte [ecx - 0x39], 0x64
cli
popfd
insb byte es:[edi], dx
jmp 0x474fc7
rcl byte ds:[ebx]
xchg esi, eax
add al, 0x63
sahf
ja 0x47502d
movsd dword es:[edi], dword [esi]
mov esi, 0xf8838998
add ecx, dword [edi]
test dword [ebx + 0xffffffc], esi
test byte [edi + 2], ah
add byte [eax], al
cmp eax, 3
jne 0x474d33
je 0x4752ed
pop ebx
clc
outsb dx, byte [esi]
or eax, edi
jg 0x47506a
pop ebp
int 0x94
mov cl, 0xcf
fdivr qword [edx - 2]
dec eax
sbb cl, al
scasb al, byte es:[edi]
loopne 0x47501c
push 0x214
push 1
call fcn.0044aedf
mov esi, eax
pop ecx
pop ecx
cmp esi, edi
je 0x474bb2
push esi
call fcn.00464525
add al, ch
imul bl
invalid
Function at 0x415030
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.NUdqtLqT
lea edi, [esi - 0xc000]
push edi
or ebp, 0xffffffff
jmp 0x415052
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x415059
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x415048
mov eax, 1
add ebx, ebx
jne 0x41506b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x415060
jne 0x41507c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x415060
xor ecx, ecx
sub eax, 3
jb 0x415090
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x415102
mov ebp, eax
add ebx, ebx
jne 0x41509b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x4150a8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x4150cc
inc ecx
add ebx, ebx
jne 0x4150b8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x4150ad
jne 0x4150c9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4150ad
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x4150ec
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x4150dd
jmp 0x41504e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x4150ec
add edi, ecx
jmp 0x41504e
pop esi
lea edi, [esi + 0x13000]
mov eax, dword [edi]
or eax, eax
je 0x41514b
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x197d8]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x19844]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x415109
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x1984c]
or eax, eax
je 0x415145
mov dword [ebx], eax
add ebx, 4
jmp 0x415126
call dword [esi + 0x19848]
mov ebp, dword [esi + 0x19850]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1ff]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x41517f
sub esp, 0xffffff80
jmp section.dUKSqJnb

Function at 0x466840
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
push esp
pop ebp
mov eax, dword [ebp + 8]
push ebx
mov ecx, dword [eax + 0x3c]
add ecx, eax
push esi
movzx eax, word [ecx + 0x14]
movzx ebx, word [ecx + 6]
add eax, 0x18
xor edx, edx
add eax, ecx
push edi
or ebx, ebx
je 0x46687c
mov edi, dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
cmp edi, esi
jb 0x466874
mov ecx, dword [eax + 8]
add ecx, esi
cmp edi, ecx
jb 0x46687e
inc edx
add eax, 0x28
cmp edx, ebx
jb 0x466864
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x466950
Capabilities:
Parse pe header

Disassembly:
push ebp
push esp
pop ebp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
je 0x466964
xor eax, eax
pop ebp
ret
mov ecx, dword [eax + 0x3c]
add ecx, eax
sub eax, eax
cmp dword [ecx], 0x4550
jne 0x46697f
mov edx, 0x10b
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
Function at 0x43b64f
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov ebx, 0x43b3c1
add eax, 1
mov esi, esi
push 0x9fcbc3f2
pop eax
call fcn.0043b687
mov esi, eax
sub esp, 4
mov dword [esp], esi
pop esi
or eax, esi
xor dword [ecx], ebx
inc esi
or esi, eax
inc ecx
inc eax
cmp ecx, edi
jne fcn.0043b64f
push eax
pop esi
sub esi, 1
ret

Function at 0x419d30
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, 0x410015
lea edi, [esi - 0xf015]
push edi
or ebp, 0xffffffff
jmp 0x419d52
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x419d59
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x419d48
mov eax, 1
add ebx, ebx
jne 0x419d6b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x419d60
jne 0x419d7c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x419d60
xor ecx, ecx
sub eax, 3
jb 0x419d90
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x419e02
mov ebp, eax
add ebx, ebx
jne 0x419d9b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x419da8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x419dcc
inc ecx
add ebx, ebx
jne 0x419db8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x419dad
jne 0x419dc9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x419dad
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x419dec
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x419ddd
jmp 0x419d4e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x419dec
add edi, ecx
jmp 0x419d4e
pop esi
mov edi, esi
mov ecx, 0x2b3
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x419e0a
cmp byte [edi], 5
jne 0x419e0a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x419e0f
lea edi, [esi + 0x17000]
mov eax, dword [edi]
or eax, eax
je 0x419e87
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x19000]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x1908c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x419e3c
mov ecx, edi
jns 0x419e6b
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x19090]
or eax, eax
je 0x419e81
mov dword [ebx], eax
add ebx, 4
jmp 0x419e59
call dword [esi + 0x190a0]
mov ebp, dword [esi + 0x19094]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x19f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x419ebb
sub esp, 0xffffff80
jmp 0x404c20
Function at 0x41ce04
Capabilities:
Parse pe header

Disassembly:
push 0xc
push 0x41d440
call fcn.0041d0c8
xor ecx, ecx
mov eax, dword [ebp + 8]
test eax, eax
je 0x41ce64
cmp eax, 0xffffffff
je 0x41ce64
mov dword [ebp - 4], ecx
mov edx, 0x5a4d
cmp word [eax], dx
jne 0x41ce5d
mov edx, dword [eax + 0x3c]
test edx, edx
js 0x41ce5d
cmp edx, 0x10000000
jae 0x41ce5d
add eax, edx
mov dword [ebp - 0x1c], eax
mov ecx, dword [eax]
sub ecx, 0x4550
neg ecx
sbb ecx, ecx
not ecx
and ecx, eax
jmp 0x41ce5a
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 4], 0xfffffffe
mov eax, ecx
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x41ced0
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
push ebx
push esi
push edi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
movzx ebx, word [ecx + 6]
add eax, 0x18
add eax, ecx
test ebx, ebx
je 0x41cf0e
mov edi, dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
cmp edi, esi
jb 0x41cf06
mov ecx, dword [eax + 8]
add ecx, esi
cmp edi, ecx
jb 0x41cf10
inc edx
add eax, 0x28
cmp edx, ebx
jb 0x41cef6
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x41cfe0
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
mov eax, 0x5a4d
cmp word [ecx], ax
jne 0x41d011
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x41d011
mov ecx, 0x10b
cmp word [eax + 0x18], cx
jne 0x41d011
mov eax, 1
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
nop
nop
nop
pop eax
nop
nop
add eax, 0x403d6f
nop
sub eax, 0x403d15
nop
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
jl 0x430030
nop
nop
nop
nop
add eax, 0xc
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
nop
nop
jne 0x43001e
nop
nop
nop
popal
nop
nop
jmp loc.00401219
Function at 0x100d407
Capabilities:
Get storage device properties

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1a20
call fcn.0101aeb0
push ebx
xor ebx, ebx
cmp dword [ebp + 8], ebx
je 0x100d547
cmp dword [ebp + 0xc], ebx
je 0x100d547
push esi
call fcn.01015baf
push 0xc
lea ecx, [ebp - 0x10]
push ebx
push ecx
call dword [eax + 0x398]
add esp, 0xc
call fcn.01015baf
push ebx
push ebx
push 3
push ebx
push 3
push ebx
push 0xe030a8d0
push ebx
lea esi, [eax + 0x198]
call fcn.01001e99
pop ecx
mov ecx, eax
call fcn.01001cc4
push eax
call dword [esi]
mov esi, eax
cmp esi, ebx
je 0x100d542
call fcn.01015baf
push ebx
lea ecx, [ebp - 4]
push ecx
push 0x300
lea ecx, [ebp - 0x610]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 0x2d1400
push esi
call dword [eax + 0x98]
test eax, eax
je 0x100d539
lea eax, [ebp - 0x310]
push eax
mov eax, dword [ebp - 0x5f8]
lea eax, [ebp + eax - 0x610]
push eax
mov byte [ebp - 0x310], bl
call fcn.010086f6
lea eax, [ebp - 0x310]
push eax
call fcn.010087f5
add esp, 0xc
call fcn.01015baf
mov ecx, dword [ebp - 0x600]
lea ecx, [ebp + ecx - 0x610]
push ecx
lea ecx, [ebp - 0x310]
push ecx
call dword [eax + 0x1e0]
lea eax, [ebp - 0x1a20]
push eax
call 0x101ad0f
pop ecx
call fcn.01015baf
lea ecx, [ebp - 0x310]
push ecx
call dword [eax + 0x104]
push eax
lea eax, [ebp - 0x310]
push eax
lea eax, [ebp - 0x1a20]
push eax
call fcn.0101abbc
push dword [ebp + 0xc]
lea eax, [ebp - 0x1a20]
push dword [ebp + 8]
push eax
call 0x101aac0
add esp, 0x18
call fcn.01015baf
push esi
call dword [eax + 0x58]
xor eax, eax
pop esi
jmp 0x100d54a
or eax, 0xffffffff
pop ebx
leave
ret

Function at 0x100f31c
Capabilities:
Access peb ldr_data

Disassembly:
xor eax, eax
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x14]
mov eax, dword [eax]
mov eax, dword [eax]
mov eax, dword [eax + 0x10]
ret
Function at 0x101014c
Capabilities:
Parse credit card information

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, eax
mov eax, dword [ebp + 8]
mov ebx, dword [eax + 0x30]
push edi
jmp 0x10102d0
cmp al, 0x5c
jne 0x1010198
inc esi
mov al, byte [esi]
test al, al
je 0x1010246
cmp al, 0x51
jne 0x10102cf
inc esi
mov al, byte [esi]
test al, al
je 0x1010246
cmp al, 0x5c
jne 0x1010176
test al, al
je 0x1010246
inc esi
cmp byte [esi], 0x45
jne 0x1010176
jmp 0x10102cf
cmp al, 0x5b
jne 0x1010229
xor edi, edi
inc esi
movzx eax, byte [esi]
cmp eax, 0x5c
jne 0x10101d1
lea eax, [esi + 1]
cmp byte [eax], 0x45
jne 0x10101b7
mov esi, eax
jmp 0x10101a2
push 3
push 0x101d518
push eax
call dword [0x1020804]
add esp, 0xc
test eax, eax
jne 0x10101dd
add esi, 3
jmp 0x10101a2
test edi, edi
jne 0x10101dd
cmp eax, 0x5e
jne 0x10101dd
inc edi
jmp 0x10101a2
lea eax, [esi + 1]
cmp byte [eax], 0x5d
jne 0x101021d
mov ecx, dword [ebp + 8]
test dword [ecx + 0x40], 0x2000000
jne 0x101021d
mov esi, eax
jmp 0x101021d
test al, al
je 0x1010246
cmp al, 0x5c
jne 0x101021d
inc esi
mov al, byte [esi]
test al, al
je 0x1010246
cmp al, 0x51
jne 0x101021d
inc esi
mov al, byte [esi]
test al, al
je 0x1010246
cmp al, 0x5c
jne 0x1010208
test al, al
je 0x1010246
inc esi
cmp byte [esi], 0x45
jne 0x1010208
inc esi
mov al, byte [esi]
cmp al, 0x5d
jne 0x10101f5
jmp 0x10102cf
cmp dword [ebp + 0x14], 0
je 0x101024e
cmp al, 0x23
jne 0x101024e
inc esi
mov al, byte [esi]
test al, al
je 0x1010246
cmp al, 0xa
jne 0x1010233
test al, al
jne 0x10102cf
or eax, 0xffffffff
pop edi
pop esi
pop ebx
pop ebp
ret
cmp al, 0x28
jne 0x10102cf
mov al, byte [esi + 1]
cmp al, 0x3f
je 0x1010269
cmp al, 0x2a
je 0x1010269
inc ebx
cmp dword [ebp + 0xc], 0
jne 0x10102cf
cmp ebx, dword [ebp + 0x10]
jmp 0x10102cd
inc esi
inc esi
cmp byte [esi], 0x50
jne 0x1010271
inc esi
mov cl, byte [esi]
cmp cl, 0x3c
jne 0x1010283
mov al, byte [esi + 1]
cmp al, 0x21
je 0x1010283
cmp al, 0x3d
jne 0x1010288
cmp cl, 0x27
jne 0x10102cf
inc ebx
cmp dword [ebp + 0xc], 0
jne 0x1010294
cmp ebx, dword [ebp + 0x10]
je 0x10102df
movzx eax, cl
inc esi
cmp eax, 0x3c
jne 0x10102a0
push 0x3e
pop eax
mov ecx, esi
jmp 0x10102a5
inc esi
movzx edx, byte [esi]
cmp edx, eax
jne 0x10102a4
cmp dword [ebp + 0xc], 0
je 0x10102cf
mov eax, esi
sub eax, ecx
cmp dword [ebp + 0x10], eax
jne 0x10102cf
push dword [ebp + 0x10]
push ecx
push dword [ebp + 0xc]
call dword [0x1020804]
add esp, 0xc
test eax, eax
je 0x10102df
inc esi
mov al, byte [esi]
test al, al
jne 0x101015f
jmp 0x1010246
mov eax, ebx
jmp 0x1010249
Function at 0x10142c0
Capabilities:
Parse pe header

Disassembly:
mov ecx, dword [esp + 4]
mov edx, 0x5a4d
xor eax, eax
cmp word [ecx], dx
jne 0x10142e7
mov edx, dword [ecx + 0x3c]
cmp edx, 0x1000
jge 0x10142e7
add ecx, edx
cmp dword [ecx], 0x4550
jne 0x10142e7
mov eax, ecx
ret

Function at 0x10177be
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
not eax
cmp dword [esp + 0xc], ecx
jbe 0x10177ec
push esi
mov edx, dword [esp + 0xc]
movzx edx, byte [ecx + edx]
movzx esi, al
xor edx, esi
shr eax, 8
xor eax, dword [edx*4 + 0x1021838]
inc ecx
cmp ecx, dword [esp + 0x10]
jb 0x10177cd
pop esi
not eax
ret

Function at 0x10177ef
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 4]
or eax, 0xffffffff
test edx, edx
je 0x101781d
mov cl, byte [edx]
test cl, cl
je 0x101781b
push esi
movzx esi, al
movzx ecx, cl
xor ecx, esi
shr eax, 8
xor eax, dword [ecx*4 + 0x1021838]
inc edx
mov cl, byte [edx]
test cl, cl
jne 0x1017801
pop esi
not eax
ret

Function at 0x4659a0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, 0x457015
lea edi, [esi - 0x56015]
push edi
or ebp, 0xffffffff
jmp 0x4659c2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x4659c9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4659b8
mov eax, 1
add ebx, ebx
jne 0x4659db
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x4659d0
jne 0x4659ec
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4659d0
xor ecx, ecx
sub eax, 3
jb 0x465a00
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x465a72
mov ebp, eax
add ebx, ebx
jne 0x465a0b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x465a18
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x465a3c
inc ecx
add ebx, ebx
jne 0x465a28
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x465a1d
jne 0x465a39
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x465a1d
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x465a5c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x465a4d
jmp 0x4659be
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x465a5c
add edi, ecx
jmp 0x4659be
pop esi
mov edi, esi
mov ecx, 0x33e
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x465a7a
cmp byte [edi], 0
jne 0x465a7a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov eax, ebx
loop 0x465a7f
lea edi, [esi + 0x63000]
mov eax, dword [edi]
or eax, eax
je 0x465aee
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x651f0]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x65254]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x465aac
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x65258]
or eax, eax
je 0x465ae8
mov dword [ebx], eax
add ebx, 4
jmp 0x465ac9
call dword [esi + 0x6525c]
popal
jmp 0x40da18
Function at 0x401219
Capabilities:
Terminate process

Disassembly:
mov eax, dword fs:[0]
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x40501c
push 0x40109a
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
push eax
fnstcw word [esp]
or word [esp], 0x300
fldcw word [esp]
add esp, 4
push 0
push 0
push 0x405028
push 0x405024
push 0x405020
call sub.CRTDLL.DLL___GetMainArgs
push dword [0x405028]
push dword [0x405024]
push dword [0x405020]
mov dword [0x405014], esp
call fcn.0040129c
add esp, 0x18
xor ecx, ecx
mov dword [ebp - 4], ecx
push eax
call sub.CRTDLL.DLL_exit
leave
ret

Function at 0x40da20
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0xb000]
push edi
or ebp, 0xffffffff
jmp 0x40da42
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x40da49
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x40da38
mov eax, 1
add ebx, ebx
jne 0x40da5b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x40da50
jne 0x40da6c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x40da50
xor ecx, ecx
sub eax, 3
jb 0x40da80
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x40daf2
mov ebp, eax
add ebx, ebx
jne 0x40da8b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x40da98
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x40dabc
inc ecx
add ebx, ebx
jne 0x40daa8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x40da9d
jne 0x40dab9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x40da9d
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x40dadc
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x40dacd
jmp 0x40da3e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x40dadc
add edi, ecx
jmp 0x40da3e
pop esi
lea edi, [esi + 0xb000]
mov eax, dword [edi]
or eax, eax
je 0x40db3b
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xd000]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xd064]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x40daf9
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xd068]
or eax, eax
je 0x40db35
mov dword [ebx], eax
add ebx, 4
jmp 0x40db16
call dword [esi + 0xd078]
mov ebp, dword [esi + 0xd06c]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1ff]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x40db6f
sub esp, 0xffffff80
jmp 0x40b206