joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46e1c0
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x38
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
push eax
lea ecx, [ebp - 4]
call fcn.0046e060
lea ecx, [ebp - 4]
call fcn.0046e190
movzx eax, al
test eax, eax
jne 0x46e1fd
mov dword [ebp - 0x18], 0
lea ecx, [ebp - 4]
call fcn.0046e080
mov eax, dword [ebp - 0x18]
jmp 0x46e325
lea ecx, [ebp - 4]
call fcn.0046e160
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
push ecx
call fcn.0046e120
add esp, 4
mov dword [ebp - 0x1c], eax
mov edx, dword [ebp - 0x1c]
sub edx, dword [ebp - 0x10]
sar edx, 1
mov dword [ebp - 0x14], edx
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 0x14]
push eax
lea ecx, [ebp - 4]
call fcn.0046e160
push eax
push 0
push 0
call fcn.0046dfa0
add esp, 0x20
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x46e263
mov dword [ebp - 0x20], 0
lea ecx, [ebp - 4]
call fcn.0046e080
mov eax, dword [ebp - 0x20]
jmp 0x46e325
push 0x66
push str.minkernelcrtsucrt_srcdesktopcrtenvget_environment_from_os.cpp
push 2
mov ecx, dword [ebp - 0xc]
push ecx
call fcn.00459e10
add esp, 0x10
push eax
lea ecx, [ebp - 8]
call fcn.00405fc0
lea ecx, [ebp - 8]
call fcn.00406040
movzx edx, al
test edx, edx
jne 0x46e2ac
mov dword [ebp - 0x24], 0
lea ecx, [ebp - 8]
call fcn.00406000
lea ecx, [ebp - 4]
call fcn.0046e080
mov eax, dword [ebp - 0x24]
jmp 0x46e325
lea ecx, [ebp - 8]
call fcn.00406120
mov dword [ebp - 0x28], eax
lea ecx, [ebp - 4]
call fcn.0046e160
mov dword [ebp - 0x2c], eax
push 0
push 0
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0x28]
push ecx
mov edx, dword [ebp - 0x14]
push edx
mov eax, dword [ebp - 0x2c]
push eax
push 0
push 0
call fcn.0046dfa0
add esp, 0x20
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0
jne 0x46e307
mov dword [ebp - 0x34], 0
lea ecx, [ebp - 8]
call fcn.00406000
lea ecx, [ebp - 4]
call fcn.0046e080
mov eax, dword [ebp - 0x34]
jmp 0x46e325
lea ecx, [ebp - 8]
call fcn.00450ef0
mov dword [ebp - 0x38], eax
lea ecx, [ebp - 8]
call fcn.00406000
lea ecx, [ebp - 4]
call fcn.0046e080
mov eax, dword [ebp - 0x38]
mov esp, ebp
pop ebp
ret
Function at 0x46e330
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x28
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
push eax
lea ecx, [ebp - 4]
call fcn.0046e060
lea ecx, [ebp - 4]
call fcn.0046e0a0
movzx eax, al
test eax, eax
jne 0x46e36d
mov dword [ebp - 0x14], 0
lea ecx, [ebp - 4]
call fcn.0046e080
mov eax, dword [ebp - 0x14]
jmp 0x46e427
lea ecx, [ebp - 4]
call fcn.0046e160
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
push ecx
call fcn.0046e120
add esp, 4
mov dword [ebp - 0x18], eax
mov edx, dword [ebp - 0x18]
sub edx, dword [ebp - 0xc]
sar edx, 1
mov dword [ebp - 0x10], edx
push 0x40
push str.minkernelcrtsucrt_srcdesktopcrtenvget_environment_from_os.cpp
push 2
mov eax, dword [ebp - 0x10]
shl eax, 1
push eax
call fcn.00459e10
add esp, 0x10
push eax
lea ecx, [ebp - 8]
call fcn.00450da0
lea ecx, [ebp - 8]
call fcn.00450e20
movzx ecx, al
test ecx, ecx
jne 0x46e3dd
mov dword [ebp - 0x1c], 0
lea ecx, [ebp - 8]
call fcn.00450dc0
lea ecx, [ebp - 4]
call fcn.0046e080
mov eax, dword [ebp - 0x1c]
jmp 0x46e427
lea ecx, [ebp - 4]
call fcn.0046e160
mov dword [ebp - 0x20], eax
lea ecx, [ebp - 8]
call fcn.00450f50
mov dword [ebp - 0x24], eax
mov edx, dword [ebp - 0x10]
shl edx, 1
push edx
mov eax, dword [ebp - 0x20]
push eax
mov ecx, dword [ebp - 0x24]
push ecx
call fcn.00416220
add esp, 0xc
lea ecx, [ebp - 8]
call fcn.00450f20
mov dword [ebp - 0x28], eax
lea ecx, [ebp - 8]
call fcn.00450dc0
lea ecx, [ebp - 4]
call fcn.0046e080
mov eax, dword [ebp - 0x28]
mov esp, ebp
pop ebp
ret
Function at 0x4776e0
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x1434
call fcn.0048bdb0
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
sar eax, 6
mov ecx, dword [ebp + 0xc]
and ecx, 0x3f
imul edx, ecx, 0x38
mov eax, dword [eax*4 + 0x4ef970]
mov ecx, dword [eax + edx + 0x18]
mov dword [ebp - 0x1434], ecx
mov edx, dword [ebp + 0x10]
add edx, dword [ebp + 0x14]
mov dword [ebp - 0x1424], edx
xor eax, eax
mov dword [ebp - 0x1410], eax
mov dword [ebp - 0x140c], eax
mov dword [ebp - 0x1408], eax
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 0x1420], ecx
mov edx, dword [ebp - 0x1420]
cmp edx, dword [ebp - 0x1424]
jae 0x4778b8
lea eax, [ebp - 5]
mov dword [ebp - 0x1430], eax
lea ecx, [ebp - 0x1404]
mov dword [ebp - 0x1418], ecx
mov edx, dword [ebp - 0x1418]
cmp edx, dword [ebp - 0x1430]
jae 0x477807
mov eax, dword [ebp - 0x1420]
cmp eax, dword [ebp - 0x1424]
jae 0x477807
mov ecx, dword [ebp - 0x1420]
mov dl, byte [ecx]
mov byte [ebp - 0x1419], dl
mov eax, dword [ebp - 0x1420]
add eax, 1
mov dword [ebp - 0x1420], eax
mov cl, byte [ebp - 0x1419]
mov byte [ebp - 0x1411], cl
movsx edx, byte [ebp - 0x1411]
cmp edx, 0xa
jne 0x4777e5
mov eax, dword [ebp - 0x1408]
add eax, 1
mov dword [ebp - 0x1408], eax
mov ecx, dword [ebp - 0x1418]
mov byte [ecx], 0xd
mov edx, dword [ebp - 0x1418]
add edx, 1
mov dword [ebp - 0x1418], edx
mov eax, dword [ebp - 0x1418]
mov cl, byte [ebp - 0x1411]
mov byte [eax], cl
mov edx, dword [ebp - 0x1418]
add edx, 1
mov dword [ebp - 0x1418], edx
jmp 0x477769
mov eax, dword [ebp - 0x1418]
lea ecx, [ebp - 0x1404]
sub eax, ecx
mov dword [ebp - 0x142c], eax
push 0
lea edx, [ebp - 0x1428]
push edx
mov eax, dword [ebp - 0x142c]
push eax
lea ecx, [ebp - 0x1404]
push ecx
mov edx, dword [ebp - 0x1434]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x477871
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x1410], eax
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x1410]
mov dword [eax], ecx
mov edx, dword [ebp - 0x140c]
mov dword [eax + 4], edx
mov ecx, dword [ebp - 0x1408]
mov dword [eax + 8], ecx
mov eax, dword [ebp + 8]
jmp 0x4778d8
mov edx, dword [ebp - 0x140c]
add edx, dword [ebp - 0x1428]
mov dword [ebp - 0x140c], edx
mov eax, dword [ebp - 0x1428]
cmp eax, dword [ebp - 0x142c]
jae 0x4778b3
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 0x1410]
mov dword [ecx], edx
mov eax, dword [ebp - 0x140c]
mov dword [ecx + 4], eax
mov edx, dword [ebp - 0x1408]
mov dword [ecx + 8], edx
mov eax, dword [ebp + 8]
jmp 0x4778d8
jmp 0x477742
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x1410]
mov dword [eax], ecx
mov edx, dword [ebp - 0x140c]
mov dword [eax + 4], edx
mov ecx, dword [ebp - 0x1408]
mov dword [eax + 8], ecx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00402f30
mov esp, ebp
pop ebp
ret
Function at 0x4778f0
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x1434
call fcn.0048bdb0
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
sar eax, 6
mov ecx, dword [ebp + 0xc]
and ecx, 0x3f
imul edx, ecx, 0x38
mov eax, dword [eax*4 + 0x4ef970]
mov ecx, dword [eax + edx + 0x18]
mov dword [ebp - 0x1434], ecx
mov edx, dword [ebp + 0x10]
add edx, dword [ebp + 0x14]
mov dword [ebp - 0x1424], edx
xor eax, eax
mov dword [ebp - 0x1410], eax
mov dword [ebp - 0x140c], eax
mov dword [ebp - 0x1408], eax
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 0x141c], ecx
mov edx, dword [ebp - 0x141c]
cmp edx, dword [ebp - 0x1424]
jae 0x477adb
lea eax, [ebp - 6]
mov dword [ebp - 0x1430], eax
lea ecx, [ebp - 0x1404]
mov dword [ebp - 0x1414], ecx
mov edx, dword [ebp - 0x1414]
cmp edx, dword [ebp - 0x1430]
jae 0x477a26
mov eax, dword [ebp - 0x141c]
cmp eax, dword [ebp - 0x1424]
jae 0x477a26
mov ecx, dword [ebp - 0x141c]
mov dx, word [ecx]
mov word [ebp - 0x141e], dx
mov eax, dword [ebp - 0x141c]
add eax, 2
mov dword [ebp - 0x141c], eax
mov cx, word [ebp - 0x141e]
mov word [ebp - 0x1418], cx
movzx edx, word [ebp - 0x1418]
cmp edx, 0xa
jne 0x477a02
mov eax, dword [ebp - 0x1408]
add eax, 2
mov dword [ebp - 0x1408], eax
mov ecx, 0xd
mov edx, dword [ebp - 0x1414]
mov word [edx], cx
mov eax, dword [ebp - 0x1414]
add eax, 2
mov dword [ebp - 0x1414], eax
mov ecx, dword [ebp - 0x1414]
mov dx, word [ebp - 0x1418]
mov word [ecx], dx
mov eax, dword [ebp - 0x1414]
add eax, 2
mov dword [ebp - 0x1414], eax
jmp 0x477979
mov ecx, dword [ebp - 0x1414]
lea edx, [ebp - 0x1404]
sub ecx, edx
sar ecx, 1
shl ecx, 1
mov dword [ebp - 0x142c], ecx
push 0
lea eax, [ebp - 0x1428]
push eax
mov ecx, dword [ebp - 0x142c]
push ecx
lea edx, [ebp - 0x1404]
push edx
mov eax, dword [ebp - 0x1434]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x477a94
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x1410], eax
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 0x1410]
mov dword [ecx], edx
mov eax, dword [ebp - 0x140c]
mov dword [ecx + 4], eax
mov edx, dword [ebp - 0x1408]
mov dword [ecx + 8], edx
mov eax, dword [ebp + 8]
jmp 0x477afb
mov eax, dword [ebp - 0x140c]
add eax, dword [ebp - 0x1428]
mov dword [ebp - 0x140c], eax
mov ecx, dword [ebp - 0x1428]
cmp ecx, dword [ebp - 0x142c]
jae 0x477ad6
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 0x1410]
mov dword [edx], eax
mov ecx, dword [ebp - 0x140c]
mov dword [edx + 4], ecx
mov eax, dword [ebp - 0x1408]
mov dword [edx + 8], eax
mov eax, dword [ebp + 8]
jmp 0x477afb
jmp 0x477952
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 0x1410]
mov dword [ecx], edx
mov eax, dword [ebp - 0x140c]
mov dword [ecx + 4], eax
mov edx, dword [ebp - 0x1408]
mov dword [ecx + 8], edx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00402f30
mov esp, ebp
pop ebp
ret
Function at 0x480130
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x4c
lea ecx, [ebp - 0x4c]
call fcn.0046b8c0
lea ecx, [ebp - 0x34]
call fcn.0046b8c0
call fcn.00466b90
push eax
lea eax, [ebp - 0x4c]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.0046a690
add esp, 0xc
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x480183
mov dword [ebp - 8], 0
lea ecx, [ebp - 0x34]
call fcn.0046b9e0
lea ecx, [ebp - 0x4c]
call fcn.0046b9e0
mov eax, dword [ebp - 8]
jmp 0x4801f8
call fcn.00466b90
push eax
lea edx, [ebp - 0x34]
push edx
mov eax, dword [ebp + 0xc]
push eax
call fcn.0046a690
add esp, 0xc
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x4801be
mov dword [ebp - 0x10], 0
lea ecx, [ebp - 0x34]
call fcn.0046b9e0
lea ecx, [ebp - 0x4c]
call fcn.0046b9e0
mov eax, dword [ebp - 0x10]
jmp 0x4801f8
lea ecx, [ebp - 0x34]
call fcn.0046bfe0
mov dword [ebp - 0x14], eax
lea ecx, [ebp - 0x4c]
call fcn.0046bfe0
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x14]
push ecx
mov edx, dword [ebp - 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov dword [ebp - 0x1c], eax
lea ecx, [ebp - 0x34]
call fcn.0046b9e0
lea ecx, [ebp - 0x4c]
call fcn.0046b9e0
mov eax, dword [ebp - 0x1c]
mov esp, ebp
pop ebp
ret
Function at 0x100142b0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov edx, dword [esp + 4]
push edi
mov edi, dword [edx + 0x9c0]
cmp edi, 0x270
jb 0x10014365
push ebx
push ebp
xor edi, edi
mov ebp, closesocket
push esi
mov esi, edi
mov ecx, dword [edx + esi*4 + 4]
xor ecx, dword [edx + esi*4]
and ecx, ebp
xor ecx, dword [edx + esi*4]
mov eax, ecx
shr ecx, 1
and eax, 1
xor ecx, dword [eax*4 + 0x10038110]
xor ecx, dword [edx + esi*4 + 0x634]
mov dword [edx + esi*4], ecx
inc esi
cmp esi, 0xe3
jl 0x100142d3
mov ebx, 0x26f
jmp 0x1001432c
mov ecx, dword [edx + esi*4 + 4]
xor ecx, dword [edx + esi*4]
and ecx, ebp
xor ecx, dword [edx + esi*4]
mov eax, ecx
shr ecx, 1
and eax, 1
xor ecx, dword [eax*4 + 0x10038110]
xor ecx, dword [edx + esi*4 - 0x38c]
mov dword [edx + esi*4], ecx
inc esi
cmp esi, ebx
jl 0x10014307
mov ecx, dword [edx + 0x9bc]
xor ecx, dword [edx]
and ecx, ebp
xor ecx, dword [edx + 0x9bc]
mov eax, ecx
shr ecx, 1
and eax, 1
pop esi
pop ebp
pop ebx
mov eax, dword [eax*4 + 0x10038110]
xor eax, dword [edx + 0x630]
xor eax, ecx
mov dword [edx + 0x9bc], eax
mov dword [edx + 0x9c0], edi
mov ecx, dword [edx + edi*4]
lea eax, [edi + 1]
mov dword [edx + 0x9c0], eax
mov eax, ecx
shr eax, 0xb
xor ecx, eax
mov eax, ecx
and eax, 0xff3a58ad
shl eax, 7
xor ecx, eax
mov eax, ecx
and eax, 0xffffdf8c
shl eax, 0xf
xor ecx, eax
mov eax, ecx
shr eax, 0x12
xor eax, ecx
pop edi
ret

Function at 0x1001478e
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
pushal
call 0x1001479d
pop dword [ebp - 0x10]
mov eax, 0x2b383d19
sub eax, 0x1b36f57c
sub dword [ebp - 0x10], eax
mov dword [ebp - 0x20], 0x75b4d695
sub dword [ebp - 0x20], 0x2762914a
mov dword [ebp - 0x1c], 0xf0a3a4cd
add dword [ebp - 0x1c], 0x418fa778
mov dword [ebp - 0x18], 0xe62081e
sub dword [ebp - 0x18], 0xc215c3f0
mov dword [ebp - 0x14], 0xd505588a
sub dword [ebp - 0x14], 0xd505588a
lea eax, [ebp - 0x20]
push eax
mov eax, 0xcb9a3c68
add eax, 0x446914b0
add eax, dword [ebp - 0x10]
call dword [eax]
mov dword [ebp - 0x20], 0x6f226219
sub dword [ebp - 0x20], 0xfaaff8c3
mov dword [ebp - 0x1c], 0x1141af11
add dword [ebp - 0x1c], 0x302ab264
mov dword [ebp - 0x18], 0xc35c52b7
add dword [ebp - 0x18], 0xa01319b5
mov dword [ebp - 0x14], 0xd48120e
sub dword [ebp - 0x14], 0xd48120e
lea ebx, [ebp - 0x20]
push ebx
push eax
mov eax, 0xecc22ee6
add eax, 0x2341227e
add eax, dword [ebp - 0x10]
call dword [eax]
push 0x40
push 0x1000
push 0x39d7f
push 0
call eax
mov ecx, 0x8a0f4a4a
sub ecx, 0x8a0f073c
mov edi, eax
mov esi, 0x1c324a9
sub esi, 0xf1baa0a9
add esi, dword [ebp - 0x10]
mov ebx, 0x3f8495a8
add ebx, 0x5474f56
xor dword [ebp - 4], 0x403bf088
mov edx, dword [esi]
add dword [ebp - 4], 0x3e812aa0
sub edx, ebx
add dword [ebp - 8], ebx
mov dword [edi], edx
xor dword [ebp - 8], esi
add edi, 0xb3e2c973
sub edi, 0xb3e2c96f
add esi, 0xc5f61aa4
add esi, 0x3a09e560
loop 0x100148bf
add eax, 0x511a28be
sub eax, 0x511929b3
xor ebx, ebx
add ebx, eax
add eax, 0xc4dfc02d
sub eax, 0xc4dfc028
mov ecx, 0x10000000
add ecx, dword [ebp - 0x10]
call ebx
leave
ret
Function at 0x4a24b0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, 7
push 0
push 0
dec ecx
jne 0x4a24b9
push ecx
xchg dword [ebp - 4], ecx
push ebx
push esi
push edi
mov esi, ecx
mov ebx, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4a2733
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x4a26dc
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.0040aa6c
add esp, 0xfffffff8
fstp qword [esp]
wait
lea eax, [ebp - 0x18]
mov edx, 0x4a274c
call fcn.0040b674
lea eax, [ebp - 0x14]
mov edx, 0x4a2768
call fcn.004046e0
lea edx, [ebp - 0x10]
xor eax, eax
call fcn.00402e84
lea edx, [ebp - 0x20]
mov eax, esi
call fcn.004095cc
mov eax, dword [ebp - 0x20]
lea edx, [ebp - 0x1c]
call fcn.004089ec
mov eax, dword [ebp - 0x1c]
mov edx, 0x4a2778
call fcn.00404a70
jne 0x4a255f
push 0x4a2788
push 0x4a2798
mov ecx, dword [0x4a7668]
mov dl, 1
mov eax, dword [0x4184e8]
call fcn.0041d7ec
mov dword [ebp - 8], eax
jmp 0x4a257e
push 0x4a27a4
push 0x4a2798
mov ecx, dword [0x4a7668]
mov dl, 1
mov eax, dword [0x4184e8]
call fcn.0041d7ec
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x4a26cb
push dword fs:[eax]
mov dword fs:[eax], esp
push ebx
push dword [ebp - 0x18]
push 0x4a27b8
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.004049e4
push 0
lea eax, [ebp - 0x24]
mov ecx, dword [ebp - 0xc]
mov edx, 0x4a27c8
call fcn.00404970
mov eax, dword [ebp - 0x24]
push eax
call fcn.004a0ab0
xor ecx, ecx
pop edx
call fcn.004a0ad0
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
call fcn.0041d5e8
push 0
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x358]
lea eax, [ebp - 0x28]
mov edx, 0x4a27ec
call fcn.00404970
mov eax, dword [ebp - 0x28]
push eax
call fcn.004a0ab0
xor ecx, ecx
pop edx
call fcn.004a0ad0
push 0
lea eax, [ebp - 0x2c]
mov ecx, dword [ebp - 0x10]
mov edx, 0x4a280c
call fcn.00404970
mov eax, dword [ebp - 0x2c]
push eax
call fcn.004a0ab0
xor ecx, ecx
pop edx
call fcn.004a0ad0
call sub.kernel32.dll_GetCurrentProcessId
mov ebx, eax
push 0
mov eax, ebx
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x34]
call fcn.00408e50
mov ecx, dword [ebp - 0x34]
lea eax, [ebp - 0x30]
mov edx, 0x4a2830
call fcn.00404970
mov eax, dword [ebp - 0x30]
push eax
call fcn.004a0ab0
xor ecx, ecx
pop edx
call fcn.004a0ad0
push 3
push 0x4a2848
push dword [ebp - 0x14]
push 0x4a2854
mov eax, dword [ebp - 4]
push dword [eax + 0x358]
push 0x4a2860
push dword [ebp - 0x10]
push 0x4a286c
mov eax, ebx
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x3c]
call fcn.00408e50
push dword [ebp - 0x3c]
lea eax, [ebp - 0x38]
mov edx, 7
call fcn.004049e4
mov eax, dword [ebp - 0x38]
call fcn.00404b24
push eax
mov eax, dword [ebp - 0xc]
call fcn.00404b24
push eax
push 0x4a2870
push 0
call sub.shell32.dll_ShellExecuteA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a26d2
mov eax, dword [ebp - 8]
call fcn.00403840
ret
Function at 0x532090
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0xdb000]
push edi
jmp 0x5320aa
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x5320b1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x5320a0
mov eax, 1
add ebx, ebx
jne 0x5320c3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x5320d4
jne 0x5320f3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x5320f3
dec eax
add ebx, ebx
jne 0x5320e0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x5320b8
add ebx, ebx
jne 0x5320ef
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x532145
xor ecx, ecx
sub eax, 3
jb 0x53210b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x53217a
sar eax, 1
mov ebp, eax
jmp 0x532116
add ebx, ebx
jne 0x532116
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x5320e4
inc ecx
add ebx, ebx
jne 0x532124
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x5320e4
add ebx, ebx
jne 0x532131
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x532126
jne 0x532142
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x532126
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x532164
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x532156
jmp 0x5320a6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x532164
add edi, ecx
jmp 0x5320a6
pop esi
mov edi, esi
mov ecx, 0x3ea9
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x532182
cmp byte [edi], 0x11
jne 0x532182
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x532187
lea edi, [esi + 0x12b000]
mov eax, dword [edi]
or eax, eax
je 0x5321ff
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x18afc4]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x18b140]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x5321b4
mov ecx, edi
jns 0x5321e3
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x18b144]
or eax, eax
je 0x5321f9
mov dword [ebx], eax
add ebx, 4
jmp 0x5321d1
call dword [esi + 0x18b154]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x532230
cmp al, 0xef
ja 0x532223
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x532205
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x532212
mov ebp, dword [esi + 0x18b148]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x22f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x532264
sub esp, 0xffffff80
jmp 0x42800a
Function at 0x9e6870
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x169000]
push edi
or ebp, 0xffffffff
jmp 0x9e6892
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x9e6899
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x9e6888
mov eax, 1
add ebx, ebx
jne 0x9e68ab
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x9e68bc
jne 0x9e68db
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x9e68db
dec eax
add ebx, ebx
jne 0x9e68c8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x9e68a0
add ebx, ebx
jne 0x9e68d7
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x9e692d
xor ecx, ecx
sub eax, 3
jb 0x9e68f3
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x9e6962
sar eax, 1
mov ebp, eax
jmp 0x9e68fe
add ebx, ebx
jne 0x9e68fe
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x9e68cc
inc ecx
add ebx, ebx
jne 0x9e690c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x9e68cc
add ebx, ebx
jne 0x9e6919
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x9e690e
jne 0x9e692a
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x9e690e
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x9e694c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x9e693e
jmp 0x9e688e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x9e694c
add edi, ecx
jmp 0x9e688e
pop esi
mov edi, esi
mov ecx, 0x8511
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x9e696a
cmp byte [edi], 0x22
jne 0x9e696a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x9e696f
lea edi, [esi + 0x5e2000]
mov eax, dword [edi]
or eax, eax
je 0x9e69e7
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x5fb074]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x5fb1f0]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x9e699c
mov ecx, edi
jns 0x9e69cb
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x5fb1f8]
or eax, eax
je 0x9e69e1
mov dword [ebx], eax
add ebx, 4
jmp 0x9e69b9
call dword [esi + 0x5fb1f4]
mov ebp, dword [esi + 0x5fb1fc]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x237]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x9e6a1b
sub esp, 0xffffff80
jmp 0x529ad2
Function at 0x149e38b
Capabilities:
Encrypt data using rc4 prga

Disassembly:
pushfd
lea esp, [esp + 4]
jne 0x14a13ec
pushal
movzx eax, cl
not ax
mov byte [edi - 1], 0
movzx ax, dl
lea eax, [ebp + 0x7c68a6e9]
push 0x42625321
movsx ax, al
mov dword [esp + 0x20], ebx
cwde
push dword [esp + 4]
pushfd
lea eax, [0x1499e67]
push esi
mov dword [esp + 0x28], 0x25ba1c5
push 0xbb093c22
mov word [esp + 8], 0x10c8
mov dword [esp + 0x28], eax
pushfd
push dword [esp + 0x2c]
ret 0x30
mov byte [esp], 6
test sp, 0xab9e
pushfd
cmp edi, ebx
push 0x3bdc90e7
lea esp, [esp + 0xc]
ja 0x2595154
or al, 0x65
not al
sbb al, bh
sub ebx, edi
movzx edi, al
lea edi, [ecx + 0x295fc1db]
shr al, 5
ror al, 5
add ebx, esp
bswap di
mov edi, ebx
neg al
mov al, 0x2e
clc
cmc
repne scasb al, byte es:[edi]
jmp 0x1448fe1

Function at 0x25bbdd5
Capabilities:
Encode data using xor

Disassembly:
cmp eax, dword [ebp - 0x10]
jmp 0x25948ab
push edx
push esi
push ss
or eax, 0xbc77c383
daa
sbb dword [edi + 0x56], edx
pop edi
push esp
rcl dword [0xe8407bb8], cl
lahf
movsb byte es:[edi], byte [esi]
lock inc byte [ebx - 0x48]
mov dl, 0xf4
cmp byte [eax + eax*2 + 0x4b], 0xff
sbb eax, 0x86950b2
call 0x149ed4f
inc ebx
mov eax, 0x7c80f4b2
inc eax
dec ebx
call [0x86950b2]
sbb byte [edi + ebx*8 - 0x6de79a87], dh
lodsd eax, dword [esi]
pop ebp
clc
xor dword [esi + 0x7d], 0x898ba997
cmpsb byte [esi], byte es:[edi]
inc esp
arpl word [ebp + 0x27ef1de2], bp
salc
jl 0x2594897
inc ebx
invalid
lea esp, [esp + 0x58]
je 0x25b64d2
push edx
stc
bt ebp, ebx
add eax, edi
pushfd
cmp eax, edx
pushfd
push ecx
mov byte [esp + 0xc], 0x4b
lea esp, [esp + 0x10]
jb 0x25b64da
push 0xba43eea6
cmp dl, ch
jmp 0x149a0c0