joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40894e
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x2c
mov esi, dword [ebp + 0xc]
mov ebx, dword [sym.imp.KERNEL32.dll_GetShortPathNameW]
mov dword [0x8b3d00], 0x55004e
mov dword [0x8b3d04], 0x4c
test esi, esi
jne 0x4089a7
mov eax, dword [ebp + 8]
mov dword [esp + 8], 0x400
mov dword [esp + 4], 0x8b3500
mov dword [esp], eax
call ebx
sub esp, 0xc
test eax, eax
je 0x408b9b
cmp eax, 0x400
jle 0x4089f8
jmp 0x408b9b
mov dword [esp + 8], 1
mov dword [esp + 4], 0
mov dword [esp], esi
call fcn.00407f8b
sub esp, 0xc
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
mov dword [esp + 8], 0x400
mov dword [esp + 4], 0x8b3d00
mov dword [esp], esi
call ebx
sub esp, 0xc
test eax, eax
je 0x408b9b
cmp eax, 0x400
jle 0x408978
jmp 0x408b9b
mov dword [esp + 0xc], 0x8b3500
mov dword [esp + 8], 0x8b3d00
mov dword [esp + 4], str._ls_ls_r_n
mov dword [esp], 0x8b3100
call dword [sym.imp.USER32.dll_wsprintfA]
mov dword [ebp - 0x1c], eax
mov eax, dword [0x555130]
mov eax, dword [eax + 0x128]
mov dword [esp], 0x8b3500
mov dword [esp + 4], eax
call fcn.00408641
push edi
push edi
mov dword [esp + 8], 4
mov dword [esp + 4], 0xc0000000
mov dword [esp], 0x8b3500
call fcn.00407f8b
sub esp, 0xc
mov edi, eax
cmp eax, 0xffffffff
je 0x408b9b
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, eax
mov eax, dword [ebp - 0x1c]
push ecx
push ecx
add eax, ebx
mov dword [ebp - 0x24], eax
add eax, 0xa
mov dword [esp + 4], eax
mov dword [esp], 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push esi
push esi
mov esi, eax
test eax, eax
je 0x408b91
mov dword [esp + 8], ebx
mov dword [esp + 4], eax
mov dword [esp], edi
call fcn.00408051
sub esp, 0xc
test eax, eax
je 0x408b91
mov dword [esp + 4], str._Rename__r_n
mov dword [esp], esi
call fcn.00407e60
push edx
push edx
lea edx, [esi + ebx]
test eax, eax
jne 0x408af2
mov dword [esp + 4], str._Rename__r_n
add ebx, 0xa
mov dword [esp], edx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov ecx, ebx
push eax
push eax
jmp 0x408b31
add eax, 0xa
mov dword [esp + 4], 0x40c68b
mov dword [esp], eax
mov dword [ebp - 0x28], edx
call fcn.00407e60
mov dword [ebp - 0x20], eax
push ecx
push ecx
mov ecx, ebx
test eax, eax
je 0x408b31
mov ecx, dword [ebp - 0x24]
mov edx, dword [ebp - 0x28]
add ecx, esi
cmp edx, dword [ebp - 0x20]
jbe 0x408b29
mov al, byte [edx]
dec edx
dec ecx
mov byte [ecx + 1], al
jmp 0x408b1b
mov eax, dword [ebp - 0x20]
sub eax, esi
lea ecx, [eax + 1]
mov eax, dword [ebp - 0x1c]
add ecx, esi
mov dword [esp + 4], 0x8b3100
mov dword [esp], ecx
mov dword [esp + 8], eax
call fcn.00407ecb
add ebx, dword [ebp - 0x1c]
sub esp, 0xc
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
sub esp, 0x10
mov dword [esp + 8], ebx
mov dword [esp + 4], esi
mov dword [esp], edi
call fcn.00408097
sub esp, 0xc
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push edx
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x408c20
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x14
mov eax, dword [ebp + 8]
mov dword [esp], 0x8b4500
mov dword [esp + 4], eax
call fcn.0040849c
push ebx
push ebx
mov dword [esp], 0x8b4500
call fcn.00407dcc
push edx
test eax, eax
jne 0x408c51
xor eax, eax
jmp 0x408ccd
mov dword [esp], eax
mov ebx, eax
call fcn.00408564
push ecx
test byte [0x55512c], 0x80
je 0x408c73
mov ax, word [ebx]
test ax, ax
je 0x408c4d
cmp ax, 0x5c
je 0x408c4d
sub ebx, 0x8b4500
sar ebx, 1
mov dword [esp], 0x8b4500
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push ecx
mov dword [esp], 0x8b4500
cmp ebx, eax
jge 0x408cb2
call fcn.00408be8
push edx
test eax, eax
je 0x408ca3
test byte [eax], 0x10
je 0x408c4d
mov dword [esp], 0x8b4500
call fcn.00407d5a
push eax
jmp 0x408c7b
call fcn.004084d0
push eax
mov dword [esp], 0x8b4500
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
inc eax
push edx
setne al
movzx eax, al
mov ebx, dword [ebp - 4]
leave
ret 4
Function at 0x408f54
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
lea ebx, [ebp - 0x244]
sub esp, 0x254
mov dword [esp + 4], 0x104
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push edx
push edx
lea edx, [eax - 1]
cmp edx, 0x103
ja 0x408f92
xor edx, edx
cmp word [ebp + eax*2 - 0x246], 0x5c
sete dl
jmp 0x408f99
xor eax, eax
mov edx, 1
mov ecx, dword [ebp + 8]
add edx, edx
add eax, eax
mov dword [esp + 4], str._s_S.dll
add edx, 0x40c660
add eax, ebx
mov dword [esp + 0xc], ecx
mov dword [esp + 8], edx
mov dword [esp], eax
call dword [sym.imp.USER32.dll_wsprintfW]
mov dword [esp], ebx
mov dword [esp + 8], 8
mov dword [esp + 4], 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov ebx, dword [ebp - 4]
sub esp, 0xc
leave
ret 4

Function at 0x409138
Capabilities:
Hash data with crc32

Disassembly:
push ebp
cmp dword [0x934564], 0
mov ebp, esp
push esi
mov edx, dword [ebp + 0xc]
push ebx
jne 0x409175
xor ecx, ecx
mov eax, ecx
mov ebx, 8
mov esi, eax
shr esi, 1
and eax, 1
je 0x409160
mov eax, 0xedb88320
xor eax, esi
dec ebx
jne 0x409152
mov dword [ecx*4 + 0x934560], eax
inc ecx
cmp ecx, 0x100
jne 0x40914b
mov eax, dword [ebp + 8]
mov ebx, dword [ebp + 0x10]
not eax
add ebx, edx
cmp edx, ebx
je 0x409197
mov cl, byte [edx]
inc edx
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x934560]
jmp 0x40917f
pop ebx
not eax
pop esi
pop ebp
ret 0xc
Function at 0x1001af13
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x1001af52
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x1001af52
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1001af52
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x1001af52
cmp dword [ecx + 0x74], 0xe
jbe 0x1001af52
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x1001dbcf
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x1001dc6c
push ebx
push esi
call fcn.1001db98
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.1001db2c
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x1001dc19
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x1001dc6b
push edi
push eax
call fcn.1001eb8a
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x1001dc39
call fcn.1001c674
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x1001dc6a
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.1001db2c
add esp, 0x20
test eax, eax
jne 0x1001dc58
push edi
call fcn.1001c674
jmp 0x1001dc60
push ebx
call fcn.1001c674
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x1001ded9
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10025cc8
push 0x10025cc0
push str.FlsAlloc
push 0x1f
call fcn.1001ddf5
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1001df0d
push dword [ebp + 8]
mov ecx, esi
call dword [0x10024150]
call esi
jmp 0x1001df13
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x1001df57
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10025cd8
push 0x10025cd0
push str.FlsGetValue
push 0x21
call fcn.1001ddf5
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1001df8e
push dword [ebp + 8]
mov ecx, esi
call dword [0x10024150]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x1001df96
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10025ce0
push 0x10025cd8
push str.FlsSetValue
push 0x22
call fcn.1001ddf5
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1001dfd0
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x10024150]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x10023650
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x1002367d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1002367d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x46b79e
Capabilities:
Execute anti-debugging instructions

Disassembly:
sub esp, 0xbc
jmp 0x46c316
mov edi, esp
xchg ecx, eax
lea ebx, [ebx + esi]

Function at 0x46bd16
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg ecx, eax
lea esp, [esp + 3]
jmp 0x46bc4d
not cl
pop dword [esp]
pop word [esp]
jmp 0x46bbd6
not ebp
bsf eax, edi
jmp 0x46bcd7
mov ecx, 0x80456ef6
mov eax, dword [esp]
lea edx, reloc.MSVCRT.dll_strncpy
xor ch, dh
jmp 0x46bc77
lea ecx, [ecx + edi]
sub esp, 9
jmp 0x46bc17
neg ebp
bsf cx, dx
jo 0x46bcad
jno 0x46bcad
movsd dword es:[edi], dword [esi]
daa
mov bh, 0xd2
and dword [ebx + reloc.MSVCRT.dll_strncpy], ebx
mov esi, 0x2c978d89
cmpsb byte [esi], byte es:[edi]
add byte [eax], al
lea edx, reloc.MSVCRT.dll_strncpy
xor ch, dh
jmp 0x46bc77
call fcn.0046bc97
xchg ecx, eax
clc
jmp 0x46bd12
lea esp, [esp + 4]
xor ebp, 0x41dc6572
sub esp, 0x19
jge 0x46bce7
neg cx
call 0x46bd16
ljmp 0xff7b
jg 0x46bc58
mov ecx, 0x80456ef6
mov eax, dword [esp]
jmp 0x46bc8d
jmp 0x46bd2c
jae 0x46bcbb
jb 0x46bcbb
bsr edx, edi
sub esp, 1
bswap eax
mov byte [esp], bh
jmp 0x46bd3a
neg cx
mov dx, word [esp + 0x12]
jmp 0x46be21
lea edx, [eax*4]
lea esp, [esp + 1]
xchg dword [esp], edx
mov eax, dword [esp]
mov ecx, 0x80a7f189
push bx
jmp 0x46c260
bsr ax, dx
jg 0x46bc6f
lea ecx, [ecx + edi]
sub esp, 9
not cl
pop dword [esp]
pop word [esp]
call fcn.0046bbbd
add ebp, dword [esi]
not ah
xchg dh, ah
jmp 0x46bd92
xor eax, ebp
jle 0x46bd76
jg 0x46bd76
setg al
jmp 0x46bdbf
xchg ch, al
setl dh
setge cl
rol ebp, 0
mov dh, byte [esp]
jmp 0x46bd8c
movzx ecx, byte [ebp]
bt eax, edx
jo 0x46be05
jno 0x46bdef
cmp byte [ecx + 0x68ab5839], ch
pop edx
retf 0x3f58
lea esp, [esp + 3]
lea esp, [esp + 0x14]
not ebp
mov dx, word [esp]
setns dh
jmp 0x46bdaf
mov eax, dword [esp]
bsr ax, ax
mov dl, 0xfe
jmp 0x46bf74
mov eax, dword [esp]
bsr ax, ax
mov dl, 0xfe
mov ah, bl
setp dh
lea eax, [ebx + 0x13]
bts eax, esi
jmp 0x46be45
neg cx
bsf cx, di
pop word [esp + 8]
jmp 0x46bddc
jns 0x46bedd
mov ah, byte [esp]
mov dl, byte [esp]
call fcn.0046be97
sbb al, 0xf6
fmul dword [ebp + reloc.MSVCRT.dll_strncpy]
add cl, al
loopne 0x46be76
neg al
lea ebx, [ebx + 0x8d]
shl eax, 0x14
setle dh
jmp 0x46beb4
add byte [edi - 0x37f0dbe4], al
mov edx, 0xe5e4d853
mov dh, bl
jmp 0x46be57
lea esp, [esp + 9]
lea esp, [esp + 3]
push dword [esp]
ret 4
rcl ah, 4
xchg dword [esp], ebx
mov dx, cx
sub esp, 0xc
xchg edx, eax
lea edx, [edi*4]
jmp 0x46be9e
mov ah, byte [esp]
mov dl, byte [esp]
call fcn.0046be2f
jmp 0x46bf2d
clc
bsf edx, esi
mov edx, ecx
jmp 0x46bf4f
bsr dx, dx
jp 0x46bf5e
mov dx, si
jmp 0x46bfb1
bsr edx, eax
inc al
xchg dl, dh
lea edx, reloc.MSVCRT.dll_strncpy
jmp 0x46bf35
mov dx, si
jmp 0x46bfb1
mov ah, bl
setp dh
jmp 0x46be13
push dword [esp + 0x10]
ret 0x14
sete dh
mov cx, bx
mov dx, word [esp]
sub esp, 0x14
add esp, 1
lea esp, [esp + 3]
jmp 0x46c001
bsf ecx, ecx
lea esp, [esp + 2]
lea edx, [edx + 0x17]
bswap ecx
bsf ax, bp
xchg dword [esp], edx
jmp 0x46c05a
mov ebx, ebp
lea ecx, [edi + edi]
jmp 0x46bd58
pop esi
rdtsc
lea eax, [edx*4]
mov ah, al
pop edi
jmp 0x46c31d
not dh
setnp dh
xchg dx, di
xchg ch, ah
mov si, ax
jmp 0x47ad04
Function at 0x46be2f
Capabilities:
Execute anti-debugging instructions

Disassembly:
sub cl, bl
lea edx, reloc.MSVCRT.dll_strncpy
jmp 0x46befe
mov dx, 0x449f
mov al, cl
mov dh, 0xef
sbb dx, 0xae2e
jb 0x46bee8
clc
bsf edx, esi
mov edx, ecx
bsr edx, eax
jmp 0x46bf52

Function at 0x46dc08
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea eax, [ecx*4]
push dword [esp]
js 0x46dc3d
jns 0x46dc27
xchg edx, eax
add eax, 0xbd0ffc95
xor al, 0x27
mov ah, 0xee
mov byte [esp + 6], cl
lea esp, [esp + 8]
dec ebp
jmp 0x46dcd0
xchg cl, dh
lea edx, [edi + edi]
call fcn.0046dcba
lea esp, [esp + 4]
dec ebp
not cx
mov dx, cx
bts ecx, edx
jmp 0x46dd23
sub ebp, 0xc80a722
mov cx, 0x8a72
mov dl, byte [esp]
bsr dx, bp
jge 0x46dd6d
jl 0x46dd49
inc esi
fimul dword [eax + 0x2f]
fisubr dword [ebp - 0x5c]
aas
scasd eax, dword es:[edi]
retf 0xf139
jo 0x46df42
xchg cl, ah
mov al, byte [esp]
jmp 0x46df47
push bx
rdtsc
jmp 0x46dd7b
mov al, byte [esp]
bsf cx, cx
sub esp, 0x10
jmp 0x46dd33
xor cl, dl
lea eax, [ebp*4]
lea eax, [ebx*4]
jmp 0x46ddbc
mov al, byte [esp]
bsf cx, cx
sub esp, 0x10
push bx
rdtsc
lea esp, [esp + 2]
ror ebp, 0
jmp 0x46de99
bsr eax, ecx
mov dx, 0x1ef7
jmp 0x46ddca
ror ebp, 0
jno 0x46dd87
bsr eax, ecx
mov dx, 0x1ef7
mov cx, word [esp]
call fcn.0046de60
ficomp word [ebp - 0x33]
xchg esp, eax
xlatb
sub al, 0x3f
push es
mov cl, 0x8d
xchg ecx, eax
mov bh, 0
add byte [eax], al
lea edx, [ecx + 0xb7]
mov ax, di
mov cl, byte [esp]
jmp 0x46dd9d
mov cx, word [esp]
add ebp, dword [edi]
sub esp, 0x10
jge 0x46de69
jl 0x46dec3
mov ah, 0x32
mov al, byte [0xb3f032c7]
stosb byte es:[edi], al
lds esi, [ebp + ecx*4 + 4]
popfd
add byte [eax], al
add byte [eax], al
lea eax, [ebx*4]
lea edx, [ecx + 0xb7]
mov ax, di
jmp 0x46ddc5
sbb ah, dl
xchg ecx, eax
sete ah
jmp fcn.0046dead
jo 0x46dd55
xor cl, dl
lea eax, [ebp*4]
jmp 0x46dde9
sbb ah, dl
xchg ecx, eax
sete ah
jmp fcn.0046dead
xchg cl, ah
mov al, byte [esp]
jmp 0x46dd00

Function at 0x480f75
Capabilities:
Execute anti-debugging instructions

Disassembly:
push ebp
jmp 0x480f7c
pushal
pop bx
sub esp, 0x17
jmp 0x480fb0
Function at 0x48181e
Capabilities:
Execute anti-debugging instructions

Disassembly:
sub cl, bl
neg edx
jbe 0x481848
mov dh, 2
push cx
mov dh, cl
lea esp, [esp + 2]
jmp 0x48189f
lea esp, [esp + 3]
jmp 0x481808
jmp 0x4818f9
mov ax, 0x2a54
sub esp, 7
lea esp, [esp + 3]
jmp 0x481939
mov dl, cl
mov eax, dword [esp]
lea eax, reloc.MSVCRT.dll_strncpy
dec eax
jmp 0x4819d8
lea esp, [esp + 4]
inc dl
mov eax, ebx
sete al
lea eax, [ecx + ebx]
jmp 0x481998
lea esp, [esp + 3]
jmp 0x481939
lea eax, [esi*4]
mov al, 0xe1
mov eax, esi
bsr ax, cx
jmp 0x4819b9
mov eax, dword [esp]
not dl
jmp 0x481960
lea eax, [esi + edi]
not dl
push ecx
jmp 0x4819a3
bts ax, si
jae 0x481976
mov eax, dword [esp]
jmp 0x481979
bswap eax
inc eax
jl 0x4819c0
jge 0x4819c0
dec ebp
leave
pop ecx
cmp bl, cl
or ebp, ebp
push 0xfffffffffffffff8
lahf
push 0xffffffffffffffdf
or esp, dword [edx - reloc.MSVCRT.dll_strncpy]
add al, 0x3e
jno 0x48197d
lea eax, [esi + edi]
jmp 0x481980
rol dl, 0
jne 0x481a00
mov eax, dword [esp]
mov eax, 0xa721d7cb
mov ah, ch
jmp 0x481ad4
jae 0x4818a1
mov ax, 0x2a54
sub esp, 7
jmp 0x48195a
mov eax, dword [esp]
mov eax, 0xa721d7cb
mov ah, ch
jmp 0x481a02
jmp 0x4819ea
mov ax, 0xd0c6
lea eax, [esp + edi]
bswap eax
bsr ax, ax
jb 0x481a68
mov eax, esp
btr eax, edx
jmp 0x481a52
dec dl
mov ah, 0x40
sub al, 0x4e
jl 0x481a80
mov ah, bl
mov al, dl
mov al, 0xfd
jmp 0x481a9a
mov eax, esp
btr eax, edx
lea esp, [esp + 4]
jmp 0x481a37
jmp 0x481a4d
mov al, dl
mov al, 0xfd
lea eax, [edx*4]
jmp 0x481a84
mov ah, bl
jmp 0x481a6a
sub bl, dl
not dh
mov ax, sp
mov edx, dword [esp]
mov edx, 0x6d0c4f88
jmp 0x481ab9
lea eax, [edx*4]
jmp 0x481a84
sub ax, sp
jmp 0x481b39
inc ebp
xor ah, 0x35
jp 0x481aa3
sub ax, sp
btc dx, cx
neg dh
clc
jmp 0x481b0c
mov ax, 0xd0c6
lea eax, [esp + edi]
jmp 0x481a09
mov dl, 0x79
jmp 0x481b1b
jle 0x481ae0
mov dl, 0x79
jmp 0x481b1b
rol cl, 0
mov dx, bx
mov dh, bl
mov dl, dh
bts eax, ebp
jmp 0x481af6
sub cl, 0x22
sete dh
or eax, eax
jne 0x481b58
je 0x481b42
scasd eax, dword es:[edi]
cmp al, 0xd2
mov ch, 0x44
test dword [ebx + reloc.MSVCRT.dll_strncpy], ebx
retf
btc dx, cx
neg dh
clc
jmp 0x481b0c
btc eax, ecx
rdtsc
lea eax, [edi*4]
jmp 0x481b64
btc eax, ecx
rdtsc
lea eax, [edi*4]
jmp 0x481b90
mov dx, word [esp]
dec dx
jmp 0x481b72
mov edx, ebp
dec cl
xchg dl, ah
bsf eax, edi
jmp 0x481f67
rol cl, 0
jo 0x481b66
mov dx, word [esp]
dec dx
mov edx, ebp
jmp 0x481b74
mov ah, dl
call fcn.00481bd0
xchg ecx, edx
mov cx, 0x2f3e
mov edx, dword [ebx]
jmp 0x481dd1
inc ecx
jmp 0x481e34
dec ecx
jno 0x481dbb
inc ecx
jmp 0x481e34
pop word [esp + 1]
pop cx
lea esp, [esp + 2]
jmp fcn.0047c910
inc ch
jmp 0x481df8
mov dword [edi], edx
sub esp, 6
jl 0x481e0e
inc ch
pop word [esp + 1]
pop cx
lea esp, [esp + 2]
jmp fcn.0047c910
rol cl, 0
neg ax
jno 0x481d94
mov ah, dl
jmp 0x481d96
js 0x482265
mov edx, ebp
mov dh, 0x66
jmp 0x482269
mov edx, ebp
mov dh, 0x66
jmp 0x481e71
Function at 0x50eb0a
Capabilities:
Access peb ldr_data

Disassembly:
push word [esp]
mov dword [esp], ecx
lea esp, [esp + 2]
mov dword [esp + 0x18], ebp
jmp 0x50eb47
jmp 0x50eaf4
mov eax, dword [eax + 0x1c]
jmp 0x50eb5c
mov dword [esp + 0x2c], edi
lea esp, [esp + 0x2c]
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
jmp 0x50eb0c
push ax
push word [esp]
mov dword [esp + 0x18], esi
pushal
lea esp, [esp + 6]
lea esp, [esp + 2]
jmp 0x50eb22
mov eax, dword [eax]
mov eax, dword [eax + 8]
push eax
jmp 0x50d0c2

Function at 0x407f80
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x6000]
push edi
or ebp, 0xffffffff
jmp 0x407fa2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x407fa9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x407f98
mov eax, 1
add ebx, ebx
jne 0x407fbb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x407fb0
jne 0x407fcc
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x407fb0
xor ecx, ecx
sub eax, 3
jb 0x407fe0
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x408052
mov ebp, eax
add ebx, ebx
jne 0x407feb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x407ff8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x40801c
inc ecx
add ebx, ebx
jne 0x408008
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x407ffd
jne 0x408019
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x407ffd
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x40803c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x40802d
jmp 0x407f9e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x40803c
add edi, ecx
jmp 0x407f9e
pop esi
mov edi, esi
mov ecx, 0x8f
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x40805a
cmp byte [edi], 0
jne 0x40805a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x40805f
lea edi, [esi + 0x5000]
mov eax, dword [edi]
or eax, eax
je 0x4080d7
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x8d64]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x8ddc]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x40808c
mov ecx, edi
jns 0x4080bb
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x8de4]
or eax, eax
je 0x4080d1
mov dword [ebx], eax
add ebx, 4
jmp 0x4080a9
call dword [esi + 0x8de0]
mov ebp, dword [esi + 0x8de8]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x217]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x40810b
sub esp, 0xffffff80
jmp 0x402130
Function at 0x4043c4
Capabilities:
Encrypt data using tea

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x479350]
mov ecx, dword [ebp + 8]
and dword [ebp - 4], 0
push ebx
mov ebx, dword [ecx]
mov dword [ebp - 0x28], eax
mov eax, dword [0x479354]
push esi
push edi
mov edi, dword [ecx + 4]
mov dword [ebp - 0x24], eax
lea eax, [ebp - 4]
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x2c], 0x9e3779b9
call fcn.004043bd
mov eax, dword [0x479358]
add dword [ebp - 4], 0x23f
mov dword [ebp - 0x18], eax
mov eax, dword [0x47935c]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x14], 0x20
mov dword [ebp - 0xc], 2
add dword [ebp - 0xc], 3
mov eax, ebx
shl eax, 4
add eax, dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
mov eax, dword [0x28737b4]
cmp eax, 0xfa9
jne 0x404445
mov dword [0x28737b0], 0xedeb2e40
cmp eax, 0x3eb
jne 0x404453
and dword [0x287323c], 0
mov edx, dword [ebp - 4]
add edx, ebx
mov eax, dword [ebp - 0x10]
shr eax, 5
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
add eax, dword [ebp - 0x1c]
mov dword [0x28737ac], 0xf4ea3dee
xor eax, edx
xor eax, dword [ebp - 0x20]
mov edx, dword [ebp - 4]
sub edi, eax
mov eax, edi
shr eax, 5
add edx, edi
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x24]
add dword [ebp - 8], eax
mov esi, edi
shl esi, 4
add esi, dword [ebp - 0x28]
xor esi, edx
cmp dword [0x28737b4], 0xb03
jne 0x4044b8
push 0
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasesLengthW]
xor eax, eax
push eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov ecx, dword [ebp + 8]
mov eax, dword [ebp - 8]
xor eax, esi
sub ebx, eax
mov dword [ebp - 0x10], ebx
mov eax, dword [ebp - 0x2c]
sub dword [ebp - 4], eax
dec dword [ebp - 0x14]
jne 0x404419
mov dword [ecx + 4], edi
pop edi
pop esi
mov dword [ecx], ebx
pop ebx
leave
ret 4

Function at 0x4044dd
Capabilities:
Create pipe

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x28737b4]
mov ecx, dword [0x2873240]
sub esp, 0xc00
push esi
shr eax, 3
xor esi, esi
cmp eax, esi
jbe 0x4045af
push ebx
push edi
mov edi, ecx
mov ebx, eax
cmp dword [0x28737b4], 0x959
jne 0x40459d
push esi
lea eax, [ebp - 0x800]
push eax
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetNumberFormatA]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateJobObjectA]
push esi
push esi
lea eax, [ebp - 0x400]
push eax
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasesA]
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_EnumDateFormatsW]
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push 0x403ee0
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
push 0x403f2c
push esi
call dword [sym.imp.KERNEL32.dll_FatalAppExitW]
push 0x403f58
push esi
call dword [sym.imp.KERNEL32.dll_SetFileShortNameW]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetProcessShutdownParameters]
push esi
lea eax, [ebp - 0xc00]
push eax
push esi
push 0x403f90
push esi
push esi
call dword [sym.imp.KERNEL32.dll_LCMapStringA]
push esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push edi
call fcn.004043c4
add edi, 8
dec ebx
jne 0x404505
pop edi
pop ebx
pop esi
leave
ret