joyce8/EMBER2024-capa huggingface dataset:
Function at 0x412d6c
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd74
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x274], ebx
mov dword [ebp - 0x278], ebx
mov dword [ebp - 0x284], ebx
mov dword [ebp - 0x288], ebx
mov dword [ebp - 0x28c], ebx
mov dword [ebp - 0x27c], ebx
mov dword [ebp - 0x280], ebx
mov dword [ebp - 0x26c], ebx
mov dword [ebp - 0x270], ebx
mov dword [ebp - 0x268], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
call fcn.00404150
lea eax, [ebp - 8]
call fcn.00404150
lea eax, [ebp - 0xc]
call fcn.00404150
xor eax, eax
push ebp
push 0x412fd4
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x264]
push eax
lea eax, [ebp - 0x268]
mov ecx, 0x412fec
mov edx, dword [ebp - 4]
call fcn.00403e14
mov eax, dword [ebp - 0x268]
call fcn.00403d98
push eax
call sub.kernel32.dll_FindFirstFileW
mov dword [ebp - 0x14], eax
push dword [ebp - 4]
push 0x412ffc
lea eax, [ebp - 0x270]
lea edx, [ebp - 0x238]
mov ecx, 0x104
call fcn.00403d6c
push dword [ebp - 0x270]
push 0x412ffc
mov eax, dword [0x41b180]
push dword [eax]
lea eax, [ebp - 0x26c]
mov edx, 5
call fcn.00403e78
mov eax, dword [ebp - 0x26c]
call fcn.0040776c
test al, al
je 0x412f52
xor eax, eax
push ebp
push 0x412f48
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp + 8], 0
jne 0x412f3e
push dword [ebp - 4]
push 0x412ffc
lea eax, [ebp - 0x280]
lea edx, [ebp - 0x238]
mov ecx, 0x104
call fcn.00403d6c
push dword [ebp - 0x280]
push 0x413004
lea eax, [ebp - 0x27c]
mov edx, 4
call fcn.00403e78
mov eax, dword [ebp - 0x27c]
lea edx, [ebp - 0x278]
call fcn.00412974
mov edx, dword [ebp - 0x278]
lea eax, [ebp - 0x274]
call fcn.0040377c
mov eax, dword [ebp - 0x274]
push eax
push dword [ebp - 0xc]
push 0x412ffc
push dword [ebp - 8]
push 0x41301c
lea eax, [ebp - 0x28c]
lea edx, [ebp - 0x238]
mov ecx, 0x104
call fcn.00403d6c
push dword [ebp - 0x28c]
push 0x413024
lea eax, [ebp - 0x288]
mov edx, 6
call fcn.00403e78
mov edx, dword [ebp - 0x288]
lea eax, [ebp - 0x284]
call fcn.0040377c
mov edx, dword [ebp - 0x284]
pop eax
call fcn.0040e6d4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x412f52
lea eax, [ebp - 0x264]
push eax
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_FindNextFileW
test eax, eax
jne 0x412e13
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_FindClose
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x412fdb
lea eax, [ebp - 0x28c]
mov edx, 2
call fcn.00403bf4
lea eax, [ebp - 0x284]
call fcn.004034e4
lea eax, [ebp - 0x280]
mov edx, 3
call fcn.00403bf4
lea eax, [ebp - 0x274]
call fcn.004034e4
lea eax, [ebp - 0x270]
mov edx, 3
call fcn.00403bf4
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00403bf4
ret
Function at 0x413030
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd74
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x274], ebx
mov dword [ebp - 0x278], ebx
mov dword [ebp - 0x284], ebx
mov dword [ebp - 0x288], ebx
mov dword [ebp - 0x28c], ebx
mov dword [ebp - 0x27c], ebx
mov dword [ebp - 0x280], ebx
mov dword [ebp - 0x26c], ebx
mov dword [ebp - 0x270], ebx
mov dword [ebp - 0x268], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
call fcn.00404150
lea eax, [ebp - 8]
call fcn.00404150
lea eax, [ebp - 0xc]
call fcn.00404150
xor eax, eax
push ebp
push 0x41328e
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x264]
push eax
lea eax, [ebp - 0x268]
mov ecx, 0x4132a8
mov edx, dword [ebp - 4]
call fcn.00403e14
mov eax, dword [ebp - 0x268]
call fcn.00403d98
push eax
call sub.kernel32.dll_FindFirstFileW
mov dword [ebp - 0x14], eax
push dword [ebp - 4]
push 0x4132b8
lea eax, [ebp - 0x270]
lea edx, [ebp - 0x238]
mov ecx, 0x104
call fcn.00403d6c
push dword [ebp - 0x270]
push 0x4132b8
mov eax, dword [0x41b3bc]
push dword [eax]
lea eax, [ebp - 0x26c]
mov edx, 5
call fcn.00403e78
mov eax, dword [ebp - 0x26c]
call fcn.0040776c
test al, al
je 0x41320c
xor eax, eax
push ebp
push 0x413202
push dword fs:[eax]
mov dword fs:[eax], esp
push dword [ebp - 4]
push 0x4132b8
lea eax, [ebp - 0x280]
lea edx, [ebp - 0x238]
mov ecx, 0x104
call fcn.00403d6c
push dword [ebp - 0x280]
push 0x4132c0
lea eax, [ebp - 0x27c]
mov edx, 4
call fcn.00403e78
mov eax, dword [ebp - 0x27c]
lea edx, [ebp - 0x278]
call fcn.0041253c
mov edx, dword [ebp - 0x278]
lea eax, [ebp - 0x274]
call fcn.0040377c
mov eax, dword [ebp - 0x274]
push eax
push dword [ebp - 0xc]
push 0x4132b8
push dword [ebp - 8]
push 0x4132e4
lea eax, [ebp - 0x28c]
lea edx, [ebp - 0x238]
mov ecx, 0x104
call fcn.00403d6c
push dword [ebp - 0x28c]
push 0x4132ec
lea eax, [ebp - 0x288]
mov edx, 6
call fcn.00403e78
mov edx, dword [ebp - 0x288]
lea eax, [ebp - 0x284]
call fcn.0040377c
mov edx, dword [ebp - 0x284]
pop eax
call fcn.0040e6d4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x41320c
lea eax, [ebp - 0x264]
push eax
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_FindNextFileW
test eax, eax
jne 0x4130d7
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_FindClose
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x413295
lea eax, [ebp - 0x28c]
mov edx, 2
call fcn.00403bf4
lea eax, [ebp - 0x284]
call fcn.004034e4
lea eax, [ebp - 0x280]
mov edx, 3
call fcn.00403bf4
lea eax, [ebp - 0x274]
call fcn.004034e4
lea eax, [ebp - 0x270]
mov edx, 3
call fcn.00403bf4
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00403bf4
ret
Function at 0x413c48
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
call fcn.00404150
xor eax, eax
push ebp
push 0x413c90
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00403d98
push eax
call sub.kernel32.dll_GetFileAttributesW
cmp eax, 0xffffffff
setne bl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x413c97
lea eax, [ebp - 4]
call fcn.00403bdc
ret

Function at 0x413ca0
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
call fcn.00404150
xor eax, eax
push ebp
push 0x413cf9
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00403d98
push eax
call sub.kernel32.dll_GetFileAttributesW
and eax, 0x10
cmp eax, 0x10
sete bl
mov eax, dword [ebp - 4]
call fcn.00413c48
test al, al
jne 0x413ce3
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x413d00
lea eax, [ebp - 4]
call fcn.00403bdc
ret
Function at 0x415e44
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0xb
push 0
push 0
dec ecx
jne 0x415e4c
push ebx
mov ebx, eax
xor eax, eax
push ebp
push 0x415fd0
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x24]
push eax
call sub.kernel32.dll_GetSystemInfo
lea eax, [ebp - 0x2c]
mov edx, dword [ebx]
call fcn.00403d88
push dword [ebp - 0x2c]
push 0x415fe0
push 0
lea eax, [ebp - 0x30]
push eax
lea edx, [ebp - 0x38]
mov eax, 0x416000
call fcn.004069a8
mov edx, dword [ebp - 0x38]
lea eax, [ebp - 0x34]
call fcn.00403d88
mov eax, dword [ebp - 0x34]
push eax
lea edx, [ebp - 0x40]
mov eax, 0x416028
call fcn.004069a8
mov edx, dword [ebp - 0x40]
lea eax, [ebp - 0x3c]
call fcn.00403d88
mov edx, dword [ebp - 0x3c]
mov eax, 0x80000002
pop ecx
call fcn.004075c0
push dword [ebp - 0x30]
push 0x416070
lea eax, [ebp - 0x28]
mov edx, 4
call fcn.00403e78
mov edx, dword [ebp - 0x28]
mov eax, ebx
call fcn.0040377c
mov edx, dword [ebx]
lea eax, [ebp - 0x4c]
mov ecx, 0x416080
call fcn.004037dc
mov edx, dword [ebp - 0x4c]
lea eax, [ebp - 0x48]
call fcn.00403d88
push dword [ebp - 0x48]
lea edx, [ebp - 0x50]
mov eax, dword [ebp - 0x10]
call fcn.0040709c
push dword [ebp - 0x50]
push 0x416070
lea eax, [ebp - 0x44]
mov edx, 3
call fcn.00403e78
mov edx, dword [ebp - 0x44]
mov eax, ebx
call fcn.0040377c
push dword [ebx]
push 0x416094
lea eax, [ebp - 0x54]
call fcn.00415ca0
push dword [ebp - 0x54]
push 0x4160a8
mov eax, ebx
mov edx, 4
call fcn.00403850
push dword [ebx]
push 0x4160b4
lea eax, [ebp - 0x58]
call fcn.00415d60
push dword [ebp - 0x58]
push 0x4160a8
mov eax, ebx
mov edx, 4
call fcn.00403850
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x415fd7
lea eax, [ebp - 0x58]
mov edx, 2
call fcn.00403508
lea eax, [ebp - 0x50]
call fcn.00403bdc
lea eax, [ebp - 0x4c]
call fcn.004034e4
lea eax, [ebp - 0x48]
mov edx, 2
call fcn.00403bf4
lea eax, [ebp - 0x40]
call fcn.004034e4
lea eax, [ebp - 0x3c]
call fcn.00403bdc
lea eax, [ebp - 0x38]
call fcn.004034e4
lea eax, [ebp - 0x34]
mov edx, 4
call fcn.00403bf4
ret
Function at 0x416fb0
Capabilities:
Capture screenshot

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff50
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4171d7
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x41cb04], 0
je 0x4171c1
cmp dword [0x41cb08], 0
je 0x4171c1
cmp dword [0x41cb0c], 0
je 0x4171c1
cmp dword [0x41cb10], 0
je 0x4171c1
cmp dword [0x41cb14], 0
je 0x4171c1
cmp dword [0x41cb18], 0
je 0x4171c1
cmp dword [0x41cb1c], 0
je 0x4171c1
cmp dword [0x41cb20], 0
je 0x4171c1
cmp dword [0x41cb24], 0
je 0x4171c1
cmp dword [0x41cb28], 0
je 0x4171c1
mov dword [ebp - 0x38], 1
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 0
push 0
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0x10]
push eax
call dword [0x41cb08]
test eax, eax
jne 0x4171c1
push 0
call sub.user32.dll_GetDC
mov ebx, eax
push 0
call sub.gdi32.dll_CreateCompatibleDC
mov esi, eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
push ebx
call sub.gdi32.dll_CreateCompatibleBitmap
mov edi, eax
push edi
push esi
call sub.gdi32.dll_SelectObject
push 0xcc0020
mov eax, dword [ebp + 0x14]
push eax
mov eax, dword [ebp - 0xc]
push eax
push ebx
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
push 0
push 0
push esi
call sub.gdi32.dll_BitBlt
lea eax, [ebp - 0x18]
call fcn.0040495c
push eax
push 0xffffffffffffffff
push 0
call dword [0x41cb24]
lea eax, [ebp - 0x14]
push eax
push 0
push edi
call dword [0x41cb10]
lea edx, [ebp - 0x90]
mov eax, dword [ebp + 0xc]
call fcn.00416edc
mov dword [ebp - 0xb0], 1
push esi
push edi
mov esi, 0x41b0ec
lea edi, [ebp - 0xac]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop edi
pop esi
mov dword [ebp - 0x9c], 1
mov dword [ebp - 0x98], 4
lea eax, [ebp + 0x10]
mov dword [ebp - 0x94], eax
lea eax, [ebp - 0xb0]
push eax
lea eax, [ebp - 0x90]
push eax
mov eax, dword [ebp - 0x18]
push eax
mov eax, dword [ebp - 0x14]
push eax
call dword [0x41cb20]
push 1
lea eax, [ebp - 0x80]
push eax
mov eax, dword [ebp - 0x18]
push eax
mov eax, dword [eax]
call dword [eax + 0x30]
lea eax, [ebp - 0x1c]
push eax
mov eax, dword [ebp - 0x18]
push eax
call dword [0x41cb28]
mov eax, dword [ebp - 0x1c]
push eax
call sub.kernel32.dll_GlobalLock
mov ecx, eax
mov eax, dword [ebp - 0x78]
mov edx, dword [ebp + 8]
xchg ecx, eax
xchg edx, eax
call fcn.004035d4
mov eax, dword [ebp - 0x14]
push eax
call dword [0x41cb1c]
mov eax, dword [ebp - 0x1c]
push eax
call sub.kernel32.dll_GlobalUnlock
push edi
call sub.gdi32.dll_DeleteObject
push esi
call sub.gdi32.dll_DeleteDC
push ebx
push 0
call sub.user32.dll_ReleaseDC
mov eax, dword [ebp - 0x10]
push eax
call dword [0x41cb0c]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4171de
lea eax, [ebp - 0x18]
call fcn.0040495c
ret
Function at 0x417668
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00403980
xor eax, eax
push ebp
push 0x4177e3
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
call fcn.004034e4
xor ebx, ebx
mov esi, 0x11
push esi
lea eax, [ebp - 0xc]
mov ecx, 1
mov edx, dword [0x417648]
call fcn.00404804
add esp, 4
mov eax, dword [ebp - 0xc]
mov dword [eax], 0x99935097
mov eax, dword [ebp - 0xc]
mov dword [eax + 4], 0x2c89d95b
mov eax, dword [ebp - 0xc]
mov dword [eax + 8], 0x6df8e950
mov eax, dword [ebp - 0xc]
mov dword [eax + 0xc], 0xdf4eff82
mov eax, dword [ebp - 0xc]
mov dword [eax + 0x10], 0xe8ead4ad
mov eax, dword [ebp - 0xc]
mov dword [eax + 0x14], 0xbb07f9ad
mov eax, dword [ebp - 0xc]
mov dword [eax + 0x18], 0xb746652e
mov eax, dword [ebp - 0xc]
mov dword [eax + 0x1c], 0x7f612d05
mov eax, dword [ebp - 0xc]
mov dword [eax + 0x20], 0xd7520332
mov eax, dword [ebp - 0xc]
mov dword [eax + 0x24], 0x20278d52
mov eax, dword [ebp - 0xc]
mov dword [eax + 0x28], 0xfe2bf75e
mov eax, dword [ebp - 0xc]
mov dword [eax + 0x2c], 0xba2aac6b
mov eax, dword [ebp - 0xc]
mov dword [eax + 0x30], 0xd1823480
mov eax, dword [ebp - 0xc]
mov dword [eax + 0x34], 0x5ef1f8a2
mov eax, dword [ebp - 0xc]
mov dword [eax + 0x38], 0x2ac162ac
mov eax, dword [ebp - 0xc]
mov dword [eax + 0x3c], 0x6ea634c0
mov eax, dword [ebp - 0xc]
mov dword [eax + 0x40], 0xf10ecec6
dec esi
test esi, esi
jl 0x417784
inc esi
xor edi, edi
mov eax, dword [ebp - 0xc]
mov edx, dword [eax + edi*4]
mov eax, dword [ebp - 4]
call fcn.0041757c
mov ebx, eax
test ebx, ebx
jne 0x417784
inc edi
dec esi
jne 0x41776c
test ebx, ebx
jne 0x4177ad
mov eax, dword [ebp - 8]
push eax
lea eax, [ebp - 0x10]
mov ecx, dword [ebp - 4]
mov edx, 0x4177fc
call fcn.004037dc
mov eax, dword [ebp - 0x10]
mov ecx, 0x41781c
xor edx, edx
call fcn.00417d84
jmp 0x4177b7
mov edx, dword [ebp - 8]
mov eax, ebx
call fcn.004174c8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4177ea
lea eax, [ebp - 0x10]
call fcn.004034e4
lea eax, [ebp - 0xc]
mov edx, dword [0x417648]
call fcn.00404810
lea eax, [ebp - 4]
call fcn.004034e4
ret
Function at 0x410172
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
pushal
mov edx, dword [ebp + 8]
mov ax, word [edx]
cmp ax, 0x5a4d
jne 0x4101a1
mov eax, dword [edx + 0x3c]
add edx, eax
mov eax, dword [edx]
cmp eax, 0x4550
jne 0x4101a1
add edx, 4
mov dword [ebp - 4], edx
popal
mov eax, dword [ebp - 4]
leave
ret 8
popal
sub eax, eax
leave
ret 8

Function at 0x410dff
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
mov ecx, 3
mov edx, 1
push ecx
push dword [ebp + 8]
call fcn.00410f04
rol eax, 8
push dword [ebp + 0xc]
push eax
call fcn.00410f20
push edx
push dword [ebp + 0x10]
push eax
call fcn.00410eec
inc edx
mov ebx, eax
push ecx
sub ecx, 3
push ecx
push dword [ebp + 8]
call fcn.00410f04
pop ecx
xor eax, ebx
inc ecx
push ecx
push dword [ebp + 8]
push eax
call fcn.00410ecb
push ecx
push dword [ebp + 8]
call fcn.00410f04
mov ebx, eax
push ecx
sub ecx, 3
push ecx
push dword [ebp + 8]
call fcn.00410f04
pop ecx
xor eax, ebx
inc ecx
push ecx
push dword [ebp + 8]
push eax
call fcn.00410ecb
push ecx
push dword [ebp + 8]
call fcn.00410f04
mov ebx, eax
push ecx
sub ecx, 3
push ecx
push dword [ebp + 8]
call fcn.00410f04
pop ecx
xor eax, ebx
inc ecx
push ecx
push dword [ebp + 8]
push eax
call fcn.00410ecb
push ecx
push dword [ebp + 8]
call fcn.00410f04
mov ebx, eax
push ecx
sub ecx, 3
push ecx
push dword [ebp + 8]
call fcn.00410f04
pop ecx
xor eax, ebx
inc ecx
push ecx
push dword [ebp + 8]
push eax
call fcn.00410ecb
cmp ecx, 0x2b
jne 0x410e0f
leave
ret 0xc

Function at 0x4124b4
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
pushal
mov byte [ebp - 0x118], 0x42
mov byte [ebp - 0x117], 0x72
mov byte [ebp - 0x116], 0x75
mov byte [ebp - 0x115], 0x74
mov byte [ebp - 0x114], 0x65
mov byte [ebp - 0x113], 0x66
mov byte [ebp - 0x112], 0x6f
mov byte [ebp - 0x111], 0x72
mov byte [ebp - 0x110], 0x63
mov byte [ebp - 0x10f], 0x69
mov byte [ebp - 0x10e], 0x6e
mov byte [ebp - 0x10d], 0x67
mov byte [ebp - 0x10c], 0x20
mov byte [ebp - 0x10b], 0x4b
mov byte [ebp - 0x10a], 0x65
mov byte [ebp - 0x109], 0x79
mov byte [ebp - 0x108], 0
mov eax, 1
lea edi, [ebp - 0x14]
mov ecx, 0x10
mov al, 0
mov byte [edi], al
inc edi
dec ecx
jne 0x412544
mov eax, dword [ebp + 8]
push 4
push 0x3000
push 0x6050
push 0
call dword [eax + 0x20]
test eax, eax
je 0x4125d6
mov dword [ebp - 4], eax
mov edi, eax
mov esi, dword [ebp + 0xc]
mov ecx, 0x6050
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x14]
push eax
push dword [ebp + 0xc]
push dword [ebp + 0xc]
push 0x6050
call fcn.004123fa
push 0x6050
push dword [ebp + 0xc]
call fcn.004101a8
test eax, eax
jne 0x4125b8
mov esi, dword [ebp - 4]
mov edi, dword [ebp + 0xc]
mov ecx, 0x6050
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x14]
push eax
call fcn.004125dd
test eax, eax
je 0x4125d6
jmp 0x412574
mov eax, dword [ebp + 8]
push 0x8000
push 0
push dword [ebp - 4]
call dword [eax + 0x28]
test eax, eax
je 0x4125d6
popal
mov eax, 1
leave
ret 8
popal
sub eax, eax
leave
ret 8
Function at 0x41260b
Capabilities:
Terminate process

Disassembly:
call fcn.00412618
push 0
call dword [sym.imp.KERNEL32.DLL_ExitProcess]

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x4207d0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x17000]
push edi
jmp 0x4207ea
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x4207f1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4207e0
mov eax, 1
add ebx, ebx
jne 0x420803
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x4207f8
jne 0x420814
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4207f8
xor ecx, ecx
sub eax, 3
jb 0x420828
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x42089a
mov ebp, eax
add ebx, ebx
jne 0x420833
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x420840
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x420864
inc ecx
add ebx, ebx
jne 0x420850
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x420845
jne 0x420861
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x420845
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x420884
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x420875
jmp 0x4207e6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x420884
add edi, ecx
jmp 0x4207e6
pop esi
mov edi, esi
mov ecx, 0xb3
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x4208a2
cmp byte [edi], 5
jne 0x4208a2
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x4208a7
lea edi, [esi + 0x1e000]
mov eax, dword [edi]
or eax, eax
je 0x420916
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x20000]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x20028]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x4208d4
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x20030]
or eax, eax
je 0x420910
mov dword [ebx], eax
add ebx, 4
jmp 0x4208f1
call dword [esi + 0x2002c]
mov ebp, dword [esi + 0x20034]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1ef]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x42094a
sub esp, 0xffffff80
jmp 0x403a55

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x4162b0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0xf000]
push edi
jmp 0x4162ca
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x4162d1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4162c0
mov eax, 1
add ebx, ebx
jne 0x4162e3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x4162d8
jne 0x4162f4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4162d8
xor ecx, ecx
sub eax, 3
jb 0x416308
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x41637a
mov ebp, eax
add ebx, ebx
jne 0x416313
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x416320
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x416344
inc ecx
add ebx, ebx
jne 0x416330
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x416325
jne 0x416341
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x416325
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x416364
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x416355
jmp 0x4162c6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x416364
add edi, ecx
jmp 0x4162c6
pop esi
lea edi, [esi + 0x14000]
mov eax, dword [edi]
or eax, eax
je 0x4163c3
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x16000]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x1606c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x416381
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x16074]
or eax, eax
je 0x4163bd
mov dword [ebx], eax
add ebx, 4
jmp 0x41639e
call dword [esi + 0x16070]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x4163f4
cmp al, 0xef
ja 0x4163e7
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x4163c9
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x4163d6
mov ebp, dword [esi + 0x16078]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1f7]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x416428
sub esp, 0xffffff80
jmp 0x405dd2

Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43200c
nop
nop
nop
nop
pop eax
nop
nop
add eax, 0x40729f
nop
sub eax, 0x407245
nop
nop
nop
mov ebx, dword [eax]
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
nop
add ebx, 4
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
nop
jl 0x432030
nop
nop
nop
add eax, 0xc
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
jne 0x43201e
nop
popal
nop
nop
nop
nop
nop
jmp 0x431219