joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10059180
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1598d88
mov eax, dword fs:[0]
push eax
sub esp, 0x80
mov eax, dword [0x15d0020]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x84], ecx
movzx eax, byte [ebp + 0x10]
push eax
lea ecx, [ebp - 0x48]
push ecx
mov ecx, dword [ebp - 0x84]
call fcn.10059060
mov dword [ebp - 4], 0
xor edx, edx
cmp dword [ebp - 0x38], 0
sete dl
movzx eax, dl
test eax, eax
jne 0x1005929b
lea ecx, [ebp - 0x2c]
push ecx
lea ecx, [ebp - 0x48]
call fcn.1005f900
mov dword [ebp - 0x88], eax
mov edx, dword [ebp - 0x88]
mov dword [ebp - 0x54], edx
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x54]
cmp dword [eax + 0x14], 0x10
jb 0x10059215
mov ecx, dword [ebp - 0x54]
mov edx, dword [ecx]
mov dword [ebp - 0x8c], edx
jmp 0x1005921e
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x8c], eax
push 0x15ab34c
mov ecx, dword [ebp - 0x8c]
push ecx
call fcn.100d67ea
add esp, 8
mov dword [ebp - 0x4c], eax
mov byte [ebp - 4], 2
push 0
push 1
lea ecx, [ebp - 0x2c]
call fcn.10023490
mov byte [ebp - 4], 0
cmp dword [ebp - 0x4c], 0
je 0x1005929b
mov edx, dword [ebp - 0x4c]
push edx
mov eax, dword [ebp + 0xc]
push eax
push 1
mov ecx, dword [ebp + 8]
push ecx
call fcn.100d6ae1
add esp, 0x10
mov edx, dword [ebp - 0x4c]
push edx
call fcn.100d6453
add esp, 4
mov byte [ebp - 0x4d], 1
mov dword [ebp - 4], 3
mov dword [ebp - 4], 4
push 0
push 1
lea ecx, [ebp - 0x48]
call fcn.10023650
mov dword [ebp - 4], 0xffffffff
mov al, byte [ebp - 0x4d]
jmp 0x100592c3
mov byte [ebp - 0x4e], 0
mov dword [ebp - 4], 5
mov dword [ebp - 4], 6
push 0
push 1
lea ecx, [ebp - 0x48]
call fcn.10023650
mov dword [ebp - 4], 0xffffffff
mov al, byte [ebp - 0x4e]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100d2b55
mov esp, ebp
pop ebp
ret 0xc
Function at 0x100592e0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1598de8
mov eax, dword fs:[0]
push eax
sub esp, 0x84
mov eax, dword [0x15d0020]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x88], ecx
movzx eax, byte [ebp + 0x10]
push eax
lea ecx, [ebp - 0x48]
push ecx
mov ecx, dword [ebp - 0x88]
call fcn.10059060
mov dword [ebp - 4], 0
xor edx, edx
cmp dword [ebp - 0x38], 0
sete dl
movzx eax, dl
test eax, eax
jne 0x10059408
lea ecx, [ebp - 0x2c]
push ecx
lea ecx, [ebp - 0x48]
call fcn.1005f900
mov dword [ebp - 0x8c], eax
mov edx, dword [ebp - 0x8c]
mov dword [ebp - 0x58], edx
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x58]
cmp dword [eax + 0x14], 0x10
jb 0x10059375
mov ecx, dword [ebp - 0x58]
mov edx, dword [ecx]
mov dword [ebp - 0x90], edx
jmp 0x1005937e
mov eax, dword [ebp - 0x58]
mov dword [ebp - 0x90], eax
push 0x15aaf84
mov ecx, dword [ebp - 0x90]
push ecx
call fcn.100d67ea
add esp, 8
mov dword [ebp - 0x4c], eax
mov byte [ebp - 4], 2
push 0
push 1
lea ecx, [ebp - 0x2c]
call fcn.10023490
mov byte [ebp - 4], 0
cmp dword [ebp - 0x4c], 0
je 0x10059408
mov edx, dword [ebp - 0x4c]
push edx
push 1
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.100d6711
add esp, 0x10
mov dword [ebp - 0x50], eax
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 0x50]
mov dword [eax], ecx
mov edx, dword [ebp - 0x4c]
push edx
call fcn.100d6453
add esp, 4
mov byte [ebp - 0x51], 1
mov dword [ebp - 4], 3
mov dword [ebp - 4], 4
push 0
push 1
lea ecx, [ebp - 0x48]
call fcn.10023650
mov dword [ebp - 4], 0xffffffff
mov al, byte [ebp - 0x51]
jmp 0x10059430
mov byte [ebp - 0x52], 0
mov dword [ebp - 4], 5
mov dword [ebp - 4], 6
push 0
push 1
lea ecx, [ebp - 0x48]
call fcn.10023650
mov dword [ebp - 4], 0xffffffff
mov al, byte [ebp - 0x52]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100d2b55
mov esp, ebp
pop ebp
ret 0xc
Function at 0x1008a820
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov dword [eax], 0x67452301
mov ecx, dword [ebp + 8]
mov dword [ecx + 4], 0xefcdab89
mov edx, dword [ebp + 8]
mov dword [edx + 8], 0x98badcfe
mov eax, dword [ebp + 8]
mov dword [eax + 0xc], 0x10325476
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.10088c30
add esp, 0xc
pop ebp
ret
Function at 0x1009a910
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 8]
cmp dword [eax + 0x9c0], 0x270
jne 0x1009a930
mov ecx, dword [ebp - 8]
call fcn.1009aa20
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 0x9c0]
mov eax, dword [ebp - 8]
mov ecx, dword [eax + edx*4]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x9c0]
add eax, 1
mov ecx, dword [ebp - 8]
mov dword [ecx + 0x9c0], eax
mov edx, dword [ebp - 4]
shr edx, 0xb
xor edx, dword [ebp - 4]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
shl eax, 7
and eax, 0x9d2c5680
xor eax, dword [ebp - 4]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
shl ecx, 0xf
and ecx, 0xefc60000
xor ecx, dword [ebp - 4]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
shr edx, 0x12
xor edx, dword [ebp - 4]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x1009aff0
Capabilities:
Hash data using crc32b

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
movzx eax, byte [0x15de510]
test eax, eax
je 0x1009b007
jmp 0x1009b0b6
mov dword [ebp - 8], 0x80000000
mov byte [ebp - 2], 0x80
mov byte [ebp - 1], 0
mov dword [ebp - 0xc], 0
mov byte [ebp - 0xd], 0x80
jmp 0x1009b02b
mov cl, byte [ebp - 0xd]
shr cl, 1
mov byte [ebp - 0xd], cl
movzx edx, byte [ebp - 0xd]
test edx, edx
je 0x1009b075
movzx eax, byte [ebp - 1]
movzx ecx, byte [ebp - 0xd]
and eax, ecx
je 0x1009b04b
mov edx, dword [ebp - 0xc]
xor edx, 0x80000000
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 0xc]
and eax, 0x80000000
je 0x1009b06b
mov ecx, dword [ebp - 0xc]
shl ecx, 1
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0xc]
xor edx, 0x4c11db7
mov dword [ebp - 0xc], edx
jmp 0x1009b073
mov eax, dword [ebp - 0xc]
shl eax, 1
mov dword [ebp - 0xc], eax
jmp 0x1009b023
mov ecx, dword [ebp - 0xc]
push ecx
call fcn.1009af50
add esp, 4
mov esi, eax
movzx edx, byte [ebp - 1]
push edx
call fcn.1009b140
add esp, 4
movzx eax, al
mov dword [eax*4 + 0x15de110], esi
mov cl, byte [ebp - 1]
add cl, 1
mov byte [ebp - 1], cl
movzx edx, byte [ebp - 1]
test edx, edx
jne 0x1009b016
mov byte [0x15de510], 1
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x1009b200
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
call fcn.1009b2a0
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
and ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov dword [edx], ecx
mov eax, dword [ebp - 8]
mov dword [eax + 0x9c0], 1
jmp 0x1009b242
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 0x9c0]
add edx, 1
mov eax, dword [ebp - 8]
mov dword [eax + 0x9c0], edx
mov ecx, dword [ebp - 8]
cmp dword [ecx + 0x9c0], 0x270
jae 0x1009b297
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x9c0]
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 0x9c0]
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + edx*4 - 4]
shr edx, 0x1e
mov ecx, dword [ebp - 8]
xor edx, dword [ecx + eax*4 - 4]
imul edx, edx, 0x6c078965
mov eax, dword [ebp - 8]
add edx, dword [eax + 0x9c0]
and edx, dword [ebp - 4]
mov ecx, dword [ebp - 8]
mov eax, dword [ecx + 0x9c0]
mov ecx, dword [ebp - 8]
mov dword [ecx + eax*4], edx
jmp 0x1009b22d
mov esp, ebp
pop ebp
ret 4
Function at 0x100cee50
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x15a4310
mov eax, dword fs:[0]
push eax
sub esp, 0x28
push esi
mov eax, dword [0x15d0020]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
mov dword [esi + 4], 0
push 0x15ae574
lea ecx, [esp + 0x10]
mov dword [esp + 0x3c], 0
mov dword [esi], 0x15ae65c
call fcn.10024ec0
mov byte [esp + 0x38], 1
call fcn.100ce2de
lea ecx, [esp + 0xc]
mov dword [esi + 8], eax
mov dword [esi + 0xc], edx
mov byte [esp + 0x38], 0
call fcn.10024fd0
mov dword [esi], 0x15ae680
mov eax, esi
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x34
ret
Function at 0x401b70
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x10], 0x400
mov dword [ebp - 4], 0
mov eax, dword [ebp + 8]
push eax
call fcn.0040deb0
add esp, 4
mov dword [ebp - 4], eax
jmp 0x401ba1
mov ecx, dword [ebp - 4]
sub ecx, 1
mov dword [ebp - 4], ecx
cmp dword [ebp - 4], 0
jbe 0x401bc5
push 1
push 0x41b514
mov edx, dword [ebp + 8]
add edx, dword [ebp - 4]
push edx
call fcn.0040e04a
add esp, 0xc
test eax, eax
jne 0x401bc3
jmp 0x401bc5
jmp 0x401b98
mov eax, dword [ebp + 8]
add eax, dword [ebp - 4]
mov dword [ebp - 0xc], eax
lea ecx, [ebp - 8]
push ecx
push 1
push 0
mov edx, dword [ebp - 0xc]
push edx
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x401c3b
lea eax, [ebp - 0x10]
push eax
push 0x423d00
push 0
push 0
push str.Content_Type
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x401c2f
push 0x41b528
call fcn.0040deb0
add esp, 4
mov dword [ebp - 0x14], eax
mov edx, dword [ebp - 0x14]
push edx
push 0x41b544
push 0x423d00
call fcn.0040e180
add esp, 0xc
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x401c61
push 0x41b560
call fcn.0040deb0
add esp, 4
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x18]
push ecx
push str.application_octet_stream
push 0x423d00
call fcn.0040e180
add esp, 0xc
mov eax, 0x423d00
mov esp, ebp
pop ebp
ret 4
Function at 0x402ab0
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
lea eax, [ebp - 0x38]
push eax
mov ecx, dword [ebp - 0xc]
add ecx, 4
call fcn.004034f0
mov ecx, dword [eax]
mov dword [ebp - 4], ecx
jmp 0x402ae9
mov edx, dword [ebp - 4]
add edx, 0x504
mov dword [ebp - 4], edx
lea eax, [ebp - 0x3c]
push eax
mov ecx, dword [ebp - 0xc]
add ecx, 4
call fcn.00403640
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 4]
cmp edx, dword [ecx]
jae 0x402b0e
mov dword [ebp - 0x10], 1
jmp 0x402b15
mov dword [ebp - 0x10], 0
movzx eax, byte [ebp - 0x10]
test eax, eax
je 0x402bb9
mov ecx, dword [ebp - 4]
mov dword [ebp - 0x20], ecx
mov edx, dword [ebp - 0x20]
mov dword [ebp - 0x24], edx
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
mov ecx, dword [ebp - 0x28]
mov edx, dword [ecx + 0x500]
mov dword [ebp - 0x14], edx
cmp dword [ebp - 0x14], 1
je 0x402b4d
cmp dword [ebp - 0x14], 2
je 0x402b5a
jmp 0x402bb4
mov eax, dword [ebp - 8]
add eax, 0x2000
mov dword [ebp - 8], eax
jmp 0x402bb4
mov ecx, dword [ebp - 4]
mov dword [ebp - 0x2c], ecx
mov edx, dword [ebp - 0x2c]
mov dword [ebp - 0x30], edx
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x34], eax
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
mov ecx, dword [ebp - 0x34]
add ecx, 0x100
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x18], eax
push 0
mov edx, dword [ebp - 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ecx, dword [ebp - 8]
lea edx, [ecx + eax + 0x1800]
mov dword [ebp - 8], edx
mov eax, dword [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x402add
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
Function at 0x403f10
Capabilities:
Get mac address on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x41a8d5
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
mov eax, 0x28c8
call fcn.00408c50
mov dword [ebp - 0x18], 0
xor eax, eax
lea ecx, [ebp - 0x54]
call fcn.00404fc0
mov dword [ebp - 4], 0
mov dword [ebp - 0x28], 0x2880
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0x28d4]
push ecx
call sub.IPHLPAPI.DLL_GetAdaptersInfo
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0
je 0x403fa1
lea edx, [ebp - 0x54]
push edx
mov ecx, dword [ebp + 8]
call fcn.00404e30
mov eax, dword [ebp - 0x18]
or eax, 1
mov dword [ebp - 0x18], eax
mov dword [ebp - 4], 1
push 0
push 1
lea ecx, [ebp - 0x54]
call fcn.00405ad0
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp + 8]
jmp 0x4040b1
lea ecx, [ebp - 0x28d4]
mov dword [ebp - 0x14], ecx
mov edx, dword [ebp - 0x14]
add edx, 0x194
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x10], 0
jmp 0x403fc8
mov eax, dword [ebp - 0x10]
add eax, 1
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 6
jge 0x40406b
mov ecx, dword [ebp - 0x1c]
movzx edx, byte [ecx]
mov dword [ebp - 0x30], edx
mov eax, dword [ebp - 0x30]
push eax
push 0x41b5d8
push 0xa
lea ecx, [ebp - 0x3c]
push ecx
call fcn.004089a0
add esp, 0x10
mov edx, dword [ebp - 0x1c]
add edx, 1
mov dword [ebp - 0x1c], edx
movsx eax, byte [ebp - 0x3c]
test eax, eax
jne 0x40400c
mov dword [ebp - 0x20], 0
jmp 0x40401b
lea ecx, [ebp - 0x3c]
push ecx
call fcn.0040deb0
add esp, 4
mov dword [ebp - 0x20], eax
mov edx, dword [ebp - 0x20]
push edx
lea eax, [ebp - 0x3c]
push eax
lea ecx, [ebp - 0x54]
call fcn.00405e70
cmp dword [ebp - 0x10], 5
je 0x404066
movsx ecx, byte [0x41b5e0]
test ecx, ecx
jne 0x404045
mov dword [ebp - 0x24], 0
jmp 0x404055
push 0x41b5e0
call fcn.0040deb0
add esp, 4
mov dword [ebp - 0x24], eax
mov edx, dword [ebp - 0x24]
push edx
push 0x41b5e0
lea ecx, [ebp - 0x54]
call fcn.00405e70
jmp 0x403fbf
jmp 0x40407f
lea edx, [ebp - 0x54]
push edx
mov ecx, dword [ebp + 8]
call fcn.00404e30
mov eax, dword [ebp - 0x18]
or eax, 1
mov dword [ebp - 0x18], eax
mov dword [ebp - 4], 2
push 0
push 1
lea ecx, [ebp - 0x54]
call fcn.00405ad0
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x4067c0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x41aa07
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xdc
mov dword [ebp - 0x28], 0
mov byte [ebp - 0x20], 0x63
mov byte [ebp - 0x1f], 0x61
mov byte [ebp - 0x1e], 0x2e
mov byte [ebp - 0x1d], 0x70
mov byte [ebp - 0x1c], 0x68
mov byte [ebp - 0x1b], 0x70
mov byte [ebp - 0x1a], 0x3f
mov byte [ebp - 0x19], 0x6d
mov byte [ebp - 0x18], 0x3d
mov byte [ebp - 0x17], 0
mov byte [ebp - 0x14], 0x26
mov byte [ebp - 0x13], 0x68
mov byte [ebp - 0x12], 0x3d
mov byte [ebp - 0x11], 0x39
mov byte [ebp - 0x10], 0x34
mov byte [ebp - 0xf], 0x39
mov byte [ebp - 0xe], 0
lea ecx, [ebp - 0x60]
call fcn.00404fc0
mov dword [ebp - 4], 0
lea eax, [ebp - 0x88]
push eax
call fcn.00403f10
mov dword [ebp - 0x2c], eax
mov ecx, dword [ebp - 0x2c]
push ecx
lea ecx, [ebp - 0x60]
call fcn.00405060
mov byte [ebp - 4], 1
push 0
push 1
lea ecx, [ebp - 0x88]
call fcn.00405ad0
mov byte [ebp - 4], 0
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x64], esp
lea edx, [ebp - 0x60]
push edx
call fcn.00404ed0
mov dword [ebp - 0x68], eax
lea eax, [ebp - 0xa0]
push eax
call fcn.00406310
mov dword [ebp - 0x30], eax
mov ecx, dword [ebp - 0x30]
mov dword [ebp - 0x34], ecx
mov edx, dword [ebp - 0x34]
push edx
lea ecx, [ebp - 0x60]
call fcn.00405060
mov byte [ebp - 4], 2
push 0
push 1
lea ecx, [ebp - 0xa0]
call fcn.00405ad0
mov byte [ebp - 4], 0
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x6c], esp
lea eax, [ebp - 0x60]
push eax
call fcn.00404ed0
mov dword [ebp - 0x70], eax
lea ecx, [ebp - 0xb8]
push ecx
call fcn.00408420
mov dword [ebp - 0x38], eax
mov edx, dword [ebp - 0x38]
mov dword [ebp - 0x3c], edx
mov eax, dword [ebp - 0x3c]
push eax
lea ecx, [ebp - 0x60]
call fcn.00405060
mov byte [ebp - 4], 3
push 0
push 1
lea ecx, [ebp - 0xb8]
call fcn.00405ad0
mov byte [ebp - 4], 0
movsx ecx, byte [ebp - 0x14]
test ecx, ecx
jne 0x406913
mov dword [ebp - 0x24], 0
jmp 0x406922
lea edx, [ebp - 0x14]
push edx
call fcn.0040deb0
add esp, 4
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
push eax
lea ecx, [ebp - 0x14]
push ecx
lea ecx, [ebp - 0x60]
call fcn.00405e70
lea edx, [ebp - 0x20]
push edx
lea ecx, [ebp - 0xe8]
call fcn.00404f50
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x44], eax
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x60]
push ecx
mov edx, dword [ebp - 0x44]
push edx
lea eax, [ebp - 0xd0]
push eax
call fcn.00404de0
mov dword [ebp - 0x48], eax
mov ecx, dword [ebp - 0x48]
push ecx
lea ecx, [ebp - 0x60]
call fcn.00405060
mov byte [ebp - 4], 5
push 0
push 1
lea ecx, [ebp - 0xd0]
call fcn.00405ad0
mov byte [ebp - 4], 6
push 0
push 1
lea ecx, [ebp - 0xe8]
call fcn.00405ad0
mov byte [ebp - 4], 0
lea edx, [ebp - 0x60]
push edx
mov ecx, dword [ebp + 8]
call fcn.00404e30
mov eax, dword [ebp - 0x28]
or eax, 1
mov dword [ebp - 0x28], eax
mov dword [ebp - 4], 7
push 0
push 1
lea ecx, [ebp - 0x60]
call fcn.00405ad0
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x4128c0
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00412580

Function at 0x484cee
Capabilities:
Encode data using xor

Disassembly:
mov esi, 0x484a08
inc ecx
sub ecx, ecx
and edx, edx
call fcn.00484d36
dec edx
or ecx, edx
xor dword [ebx], esi
sub ecx, edx
or ecx, ecx
add ecx, 0x44800b8f
add ebx, 2
sub edx, 0x8c9a7369
sub ecx, 0x2e671e08
cmp ebx, edi
jl fcn.00484cee
mov edx, edx
ret
Function at 0x45c6f0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x38000]
push edi
or ebp, 0xffffffff
jmp 0x45c712
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x45c719
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x45c708
mov eax, 1
add ebx, ebx
jne 0x45c72b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x45c720
jne 0x45c73c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x45c720
xor ecx, ecx
sub eax, 3
jb 0x45c750
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x45c7c2
mov ebp, eax
add ebx, ebx
jne 0x45c75b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x45c768
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x45c78c
inc ecx
add ebx, ebx
jne 0x45c778
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x45c76d
jne 0x45c789
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x45c76d
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x45c7ac
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x45c79d
jmp 0x45c70e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x45c7ac
add edi, ecx
jmp 0x45c70e
pop esi
mov edi, esi
mov ecx, 0x1b
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x45c7ca
cmp byte [edi], 0
jne 0x45c7ca
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x45c7cf
lea edi, [esi + 0x5a000]
mov eax, dword [edi]
or eax, eax
je 0x45c83e
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x62bac]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x62c18]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x45c7fc
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x62c20]
or eax, eax
je 0x45c838
mov dword [ebx], eax
add ebx, 4
jmp 0x45c819
call dword [esi + 0x62c1c]
mov ebp, dword [esi + 0x62c24]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x207]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x45c872
sub esp, 0xffffff80
jmp 0x401a50

Function at 0xb6bce4
Capabilities:
Encode data using xor

Disassembly:
jmp 0xb6bcee
pushal
call 0xb6bcf4
pop ebp
sub ebp, 0x10
sub ebp, 0x76bce4
jmp 0xb6bd0a
mov eax, 0x76bce4
add eax, ebp
add eax, 0x4c
mov ecx, 0x606
mov edx, 0x1855c7a7
xor byte [eax], dl
inc eax
dec ecx
jne 0xb6bd21
jmp 0xb6bd34
sub al, 0x6a
sub al, 0x2e
wait
cmpsd dword [esi], dword es:[edi]
cmpsd dword [esi], dword es:[edi]
cmpsd dword [esi], dword es:[edi]
pop di
cmpsd dword [esi], dword es:[edi]
cmpsd dword [esi], dword es:[edi]
cmpsd dword [esi], dword es:[edi]
movsb byte es:[edi], byte [esi]
push 0x1f
mov byte [0x1da7a7a7], al
invalid
Function at 0x4322ae
Capabilities:
Decompress data using aplib

Disassembly:
push ebp
mov ebp, esp
pushal
push ebp
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add dl, dl
jne 0x4322cb
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x4322bc
add dl, dl
jne 0x4322d6
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x432322
xor eax, eax
add dl, dl
jne 0x4322e3
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x4323bf
add dl, dl
jne 0x4322f2
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x4322fd
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x432308
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x432313
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x43231d
push edi
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
jmp 0x4322c2
mov eax, 1
add dl, dl
jne 0x432330
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x43233b
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x432327
sub eax, 2
jne 0x43236a
mov ecx, 1
add dl, dl
jne 0x432350
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x43235b
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x432347
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x4322c2
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x432381
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x43238c
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x432378
cmp eax, 0x7d00
jae 0x4323af
cmp eax, 0x500
jb 0x4323aa
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x4322c2
cmp eax, 0x7f
ja 0x4323b2
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x4322c2
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x4323db
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x4322c2
pop ebp
sub edi, dword [ebp + 0xc]
mov dword [ebp - 4], edi
popal
pop ebp
ret 8