joyce8/EMBER2024-capa huggingface dataset:
Function at 0x413070
Capabilities:
Hide graphical window

Disassembly:
push esi
test eax, eax
je 0x41307a
lea esi, [eax - 0x58]
jmp 0x41307c
xor esi, esi
cmp byte [eax + 0x1c], 0
je 0x4130b0
mov eax, dword [esi + 4]
push 0xe801
push eax
call dword [sym.imp.USER32.dll_GetDlgItem]
cmp edi, 2
jne 0x4130a1
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x4130b5
test edi, edi
jne 0x4130b0
push 5
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x4130b5
cmp edi, 1
je 0x4130cb
mov ecx, ebx
shr ecx, 0x10
movsx edx, cx
movsx eax, bx
push edx
push eax
add esi, 0x58
push esi
call fcn.00413520
xor eax, eax
pop esi
ret

Function at 0x413270
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x138
mov eax, dword [0x437454]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
mov esi, dword [0x43a014]
push edi
push 0xf0
push 0x65
mov edi, 1
push esi
mov dword [ebp - 0x110], eax
mov dword [ebp - 0x10c], edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x41343a
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x41343a
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x41343a
push ebx
mov ebx, dword [sym.imp.USER32.dll_SendDlgItemMessageW]
jmp 0x4132e6
mov edi, dword [ebp - 0x10c]
movzx eax, word [esi]
xor ecx, ecx
cmp cx, ax
je 0x413425
mov edx, dword [esi + 4]
mov edi, eax
movzx eax, word [esi + 2]
mov ecx, 0x403
add esi, 8
mov dword [ebp - 0x114], edx
cmp cx, ax
jne 0x413377
push 3
push esi
lea eax, [ebp - 0x108]
lea edx, [ebp - 0x104]
push eax
mov dword [ebp - 0x108], edx
call fcn.00413b00
mov ecx, dword [ebp - 0x108]
mov eax, dword [ebp - 0x110]
push ecx
mov ecx, dword [eax + 4]
push 0
push 0x143
push edi
push ecx
call ebx
cmp eax, 0xffffffff
jne 0x413355
mov dword [ebp - 0x10c], 0
mov eax, dword [ebp - 0x108]
lea edx, [ebp - 0x104]
cmp eax, edx
je 0x4133f9
push eax
call fcn.0041885b
add esp, 4
jmp 0x4133f9
mov ecx, 0x1234
cmp cx, ax
jne 0x4133f9
push 3
push esi
lea eax, [ebp - 0x108]
lea edx, [ebp - 0x104]
push eax
mov dword [ebp - 0x138], 1
mov dword [ebp - 0x134], 0xffffffff
mov dword [ebp - 0x108], edx
call fcn.00413b00
mov eax, dword [ebp - 0x108]
lea ecx, [ebp - 0x104]
mov dword [ebp - 0x130], eax
cmp eax, ecx
je 0x4133cf
push eax
call fcn.0041885b
add esp, 4
mov ecx, dword [ebp - 0x110]
lea edx, [ebp - 0x138]
push edx
mov edx, dword [ecx + 4]
push 0
push 0x40b
push edi
push edx
call ebx
cmp eax, 0xffffffff
jne 0x4133f9
mov dword [ebp - 0x10c], 0
add esi, dword [ebp - 0x114]
cmp dword [ebp - 0x10c], 0
jne 0x4132e0
mov eax, dword [ebp - 0x10c]
pop ebx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041884c
mov esp, ebp
pop ebp
ret 4
pop ebx
mov eax, edi
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041884c
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
xor ecx, ebp
pop esi
call fcn.0041884c
mov esp, ebp
pop ebp
ret 4
Function at 0x4141c0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
mov eax, dword [esi]
mov edx, dword [eax + 4]
push edi
xor edi, edi
call edx
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x414274
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x414274
mov edx, eax
shr edx, 0x10
test edx, edx
jne 0x4141f2
movzx eax, ax
mov edi, dword [ebp + 8]
push ebx
push ecx
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov ebx, eax
test ebx, ebx
je 0x41426b
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
mov eax, dword [ebp + 8]
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x41426b
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp + 8], eax
test eax, eax
je 0x41426b
lea ebx, [edi + 0x10]
push ebx
call fcn.0041a514
push ebx
xor ebx, ebx
push ebx
push eax
mov dword [esi + 4], eax
call fcn.00423b30
mov ecx, dword [ebp + 8]
mov edx, dword [esi + 4]
push edi
push ecx
push edx
mov dword [esi + 8], edi
call fcn.00422ba0
add esp, 0x1c
mov dword [esi + 0xc], ebx
mov dword [esi + 0x18], ebx
pop ebx
mov eax, 1
pop edi
mov dword [esi + 0x14], eax
pop esi
pop ebp
ret 0xc
pop ebx
pop edi
xor eax, eax
pop esi
pop ebp
ret 0xc
mov eax, edi
pop edi
pop esi
pop ebp
ret 0xc

Function at 0x414840
Capabilities:
Create thread

Disassembly:
cmp dword [esi + 8], 0
jne 0x41486f
mov ecx, dword [esi + 4]
lea eax, [esi + 0xc]
push eax
push 0
push esi
push ecx
push 0
push 0
call fcn.0041b29b
add esp, 0x18
test eax, eax
setne dl
mov dword [esi + 8], eax
mov byte [esi + 0x10], dl
mov dword [esi + 0x14], 0xffffffff
ret
Function at 0x416670
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
test ecx, ecx
jne 0x416677
xor eax, eax
ret
push esi
not eax
cmp edx, 8
jb 0x41674d
mov esi, edx
shr esi, 3
push edi
lea esp, [esp]
movzx edi, byte [ecx]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x42fd20]
movzx edi, byte [ecx + 1]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x42fd20]
movzx edi, byte [ecx + 2]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x42fd20]
movzx edi, byte [ecx + 3]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x42fd20]
movzx edi, byte [ecx + 4]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x42fd20]
movzx edi, byte [ecx + 5]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x42fd20]
movzx edi, byte [ecx + 6]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x42fd20]
movzx edi, byte [ecx + 7]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x42fd20]
add ecx, 8
sub edx, 8
dec esi
jne 0x416690
pop edi
test edx, edx
je 0x41676a
movzx esi, byte [ecx]
xor esi, eax
and esi, 0xff
shr eax, 8
xor eax, dword [esi*4 + 0x42fd20]
inc ecx
dec edx
jne 0x416751
not eax
pop esi
ret

Function at 0x416dd0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ebx
imul esi, dword [ebp + 0xc]
cmp byte [edi], 0
je 0x416e06
mov ecx, dword [ebp + 8]
mov edx, dword [edi + 4]
push 0
lea eax, [ebp + 0xc]
push eax
push esi
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x416dfc
mov byte [edi + 8], 1
mov eax, dword [ebp + 0xc]
xor edx, edx
div ebx
pop esi
pop ebp
ret
mov ecx, dword [edi + 0x18]
mov eax, dword [edi + 0x14]
lea edx, [ecx + esi]
cmp edx, eax
jbe 0x416e17
sub eax, ecx
mov esi, eax
mov eax, dword [edi + 0x10]
add eax, ecx
mov ecx, dword [ebp + 8]
push esi
push eax
push ecx
call fcn.00422ba0
add dword [edi + 0x18], esi
add esp, 0xc
mov eax, esi
xor edx, edx
div ebx
pop esi
pop ebp
ret

Function at 0x416e40
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
cmp byte [esi], 0
push edi
mov edi, 1
je 0x416e73
mov edx, dword [esi + 4]
push 0
lea eax, [ebp - 8]
push eax
push edi
lea ecx, [ebp - 1]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x416e6e
mov byte [esi + 8], 1
mov edi, dword [ebp - 8]
jmp 0x416e9e
mov eax, dword [esi + 0x14]
push ebx
mov ebx, dword [esi + 0x18]
lea ecx, [ebx + 1]
cmp ecx, eax
jbe 0x416e85
sub eax, ebx
mov edi, eax
mov edx, dword [esi + 0x10]
push edi
add edx, ebx
push edx
lea eax, [ebp - 1]
push eax
call fcn.00422ba0
add esp, 0xc
add ebx, edi
mov dword [esi + 0x18], ebx
pop ebx
cmp edi, 1
pop edi
jne 0x416eb3
movzx ecx, byte [ebp - 1]
mov edx, dword [ebp + 8]
mov dword [edx], ecx
xor eax, eax
mov esp, ebp
pop ebp
ret
cmp byte [esi], 0
je 0x416ead
cmp byte [esi + 8], 0
je 0x416ead
or eax, 0xffffffff
mov esp, ebp
pop ebp
ret
Function at 0x416f50
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
cmp byte [esi], 0
je 0x416f97
cmp byte [esi + 1], 0
je 0x416f9f
mov eax, dword [esi + 4]
push 2
push 0
push 0
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp byte [esi], 0
push ebx
je 0x416fb1
cmp byte [esi + 1], 0
je 0x416fa5
mov edx, dword [esi + 4]
push 1
push 0
push 0
push edx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov ebx, eax
sub ebx, dword [esi + 0xc]
mov dword [ebp - 4], ebx
jmp 0x416fb9
mov ecx, dword [esi + 0x14]
mov dword [esi + 0x18], ecx
jmp 0x416f71
xor eax, eax
mov esp, ebp
pop ebp
ret
mov dword [ebp - 4], 0
mov ebx, dword [ebp - 4]
jmp 0x416fb9
mov eax, dword [esi + 0x18]
mov dword [ebp - 4], eax
mov ebx, eax
push edi
mov edi, 0xffff
mov dword [ebp - 8], edi
cmp ebx, edi
jae 0x416fcb
mov dword [ebp - 8], ebx
mov edi, ebx
push 0x404
call fcn.00418895
add esp, 4
mov dword [ebp - 0x10], eax
test eax, eax
jne 0x416fe5
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, 4
mov dword [ebp - 0x14], 0
cmp edi, eax
jbe 0x4170f9
jmp 0x417009
mov edi, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
mov ebx, dword [ebp - 4]
add eax, 0x400
mov dword [ebp - 0xc], edi
cmp eax, edi
ja 0x417018
mov dword [ebp - 0xc], eax
mov eax, ebx
sub eax, dword [ebp - 0xc]
sub ebx, eax
mov dword [ebp - 0x1c], eax
cmp ebx, 0x404
jbe 0x41702f
mov ebx, 0x404
cmp byte [esi], 0
je 0x417054
cmp byte [esi + 1], 0
je 0x4170f9
mov ecx, dword [esi + 0xc]
mov edx, dword [esi + 4]
push 0
push 0
add ecx, eax
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
jmp 0x417057
mov dword [esi + 0x18], eax
cmp byte [esi], 0
mov edi, ebx
je 0x417080
mov ecx, dword [ebp - 0x10]
mov edx, dword [esi + 4]
push 0
lea eax, [ebp - 0x18]
push eax
push ebx
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x41707b
mov byte [esi + 8], 1
mov eax, dword [ebp - 0x18]
jmp 0x4170a9
mov eax, dword [esi + 0x18]
mov ecx, dword [esi + 0x14]
lea edx, [eax + ebx]
cmp edx, ecx
jbe 0x417091
sub ecx, eax
mov edi, ecx
mov ecx, dword [esi + 0x10]
mov edx, dword [ebp - 0x10]
push edi
add ecx, eax
push ecx
push edx
call fcn.00422ba0
add esp, 0xc
add dword [esi + 0x18], edi
mov eax, edi
xor edx, edx
div ebx
cmp eax, 1
jne 0x4170f9
lea eax, [ebx - 3]
test eax, eax
jle 0x4170ed
lea esp, [esp]
mov ecx, dword [ebp - 0x10]
dec eax
cmp byte [eax + ecx], 0x50
jne 0x4170df
cmp byte [eax + ecx + 1], 0x4b
jne 0x4170df
cmp byte [eax + ecx + 2], 5
jne 0x4170df
cmp byte [eax + ecx + 3], 6
je 0x4170e5
test eax, eax
jg 0x4170c0
jmp 0x4170ed
add eax, dword [ebp - 0x1c]
mov dword [ebp - 0x14], eax
jne 0x4170f9
mov edx, dword [ebp - 8]
cmp dword [ebp - 0xc], edx
jb 0x417000
mov eax, dword [ebp - 0x10]
push eax
call fcn.0041885b
mov eax, dword [ebp - 0x14]
add esp, 4
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x417e00
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [esi], 0
push edi
jne 0x417e7b
cmp dword [esi + 4], 0xffffffff
jne 0x417e7b
lea edi, [esi + 0x138]
push edi
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
add edi, 0xfffffffe
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x417e25
mov eax, dword [0x431d9c]
push 0x1c
mov dword [edi], eax
mov dword [ebp - 4], 0
call fcn.0041ab1b
mov ecx, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
add esp, 4
mov word [eax], 0x100
mov dword [eax + 0x10], ecx
mov dword [eax + 0x14], edx
mov dword [eax + 0x18], 0
mov dword [eax + 0xc], 0
call fcn.00417110
mov dword [esi], eax
mov eax, dword [0x44c00c]
pop edi
mov esp, ebp
pop ebp
ret 8
mov eax, 0x1000000
pop edi
mov esp, ebp
pop ebp
ret 8

Function at 0x41884c
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x437454]
jne 0x418856
repz ret
jmp fcn.0041b679
Function at 0x424add
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x437454]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.0041bd18
and dword [ebp - 0x14], 0
cmp dword [0x439ef4], 0
mov dword [ebp - 0x18], eax
jne 0x424b90
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x424c38
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x42d8f0
push ebx
call edi
test eax, eax
je 0x424c38
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x439ef4], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x439ef8], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x439efc], eax
call edi
push eax
call esi
mov dword [0x439f04], eax
test eax, eax
je 0x424b90
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x439f00], eax
mov eax, dword [0x439f00]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x424be9
cmp dword [0x439f04], ecx
je 0x424be9
push eax
call esi
push dword [0x439f04]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x424be9
test ebx, ebx
je 0x424be9
call edi
test eax, eax
je 0x424be0
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x424be0
test byte [ebp - 8], 1
jne 0x424be9
or dword [ebp + 0x10], 0x200000
jmp 0x424c1c
mov eax, dword [0x439ef8]
cmp eax, dword [ebp - 0x18]
je 0x424c1c
push eax
call esi
test eax, eax
je 0x424c1c
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x424c1c
mov eax, dword [0x439efc]
cmp eax, dword [ebp - 0x18]
je 0x424c1c
push eax
call esi
test eax, eax
je 0x424c1c
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x439ef4]
call esi
test eax, eax
je 0x424c38
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x424c3a
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0041884c
leave
ret
Function at 0x42962b
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
cmp dword [0x43a050], 0
push esi
push edi
jne 0x4295a1
call fcn.0042950d
test eax, eax
je 0x4295e6
mov eax, dword [0x43a050]
cmp eax, 1
jne 0x4295c2
push 0xd
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
je 0x4295e6
jmp 0x429628
mov edi, dword [sym.imp.KERNEL32.dll_InterlockedPopEntrySList]
push eax
call edi
test eax, eax
jne 0x429628
push 0x40
mov eax, 0x1000
push eax
push eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov esi, eax
test esi, esi
jne 0x4295ea
xor eax, eax
jmp 0x429628
mov eax, dword [esi]
push dword [0x43a050]
call edi
mov edi, eax
test edi, edi
je 0x42960c
push 0x8000
push 0
push esi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
mov eax, edi
jmp 0x429628
lea edi, [esi + 0xff0]
push esi
push dword [0x43a050]
call dword [sym.imp.KERNEL32.dll_InterlockedPushEntrySList]
add esi, 0x10
cmp esi, edi
jb 0x429612
mov eax, esi
pop edi
pop esi
ret
jmp 0x42958d

Function at 0x4297d0
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
cmp dword [ebp + 8], 0
jne 0x4297f8
call fcn.00418d3f
and dword [eax], 0
call fcn.00418d2c
mov dword [eax], 0x16
call fcn.0041bb6c
or eax, 0xffffffff
pop ebp
ret
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x429815
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00418d52
pop ecx
jmp 0x4297f3
test byte [ebp + 0xc], 0x80
je 0x429820
and eax, 0xfffffffe
jmp 0x429823
or eax, 1
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
test eax, eax
je 0x429806
xor eax, eax
pop ebp
ret
Function at 0x401291
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x40b040]
jne 0x40129b
repz ret
jmp fcn.0040152a

Function at 0x4045cc
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.004027e6
and dword [ebp - 4], 0
cmp dword [0x40c72c], 0
mov ebx, eax
jne 0x40467d
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x40472e
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x40472e
push eax
call fcn.00402774
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x40c72c], eax
call esi
push eax
call fcn.00402774
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x40c730], eax
call esi
push eax
call fcn.00402774
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x40c734], eax
call esi
push eax
call fcn.00402774
pop ecx
mov dword [0x40c73c], eax
test eax, eax
je 0x40467d
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00402774
pop ecx
mov dword [0x40c738], eax
mov eax, dword [0x40c738]
cmp eax, ebx
je 0x4046d5
cmp dword [0x40c73c], ebx
je 0x4046d5
push eax
call fcn.004027ef
push dword [0x40c73c]
mov esi, eax
call fcn.004027ef
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x4046d5
test edi, edi
je 0x4046d5
call esi
test eax, eax
je 0x4046cc
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x4046cc
test byte [ebp - 0xc], 1
jne 0x4046d5
or dword [ebp + 0x10], 0x200000
jmp 0x40470e
mov eax, dword [0x40c730]
cmp eax, ebx
je 0x40470e
push eax
call fcn.004027ef
pop ecx
test eax, eax
je 0x40470e
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x40470e
mov eax, dword [0x40c734]
cmp eax, ebx
je 0x40470e
push eax
call fcn.004027ef
pop ecx
test eax, eax
je 0x40470e
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x40c72c]
call fcn.004027ef
pop ecx
test eax, eax
je 0x40472e
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x404730
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x48c680
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x62000]
push edi
jmp 0x48c69a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x48c6a1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x48c690
mov eax, 1
add ebx, ebx
jne 0x48c6b3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x48c6c4
jne 0x48c6e3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x48c6e3
dec eax
add ebx, ebx
jne 0x48c6d0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x48c6a8
add ebx, ebx
jne 0x48c6df
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x48c735
xor ecx, ecx
sub eax, 3
jb 0x48c6fb
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x48c76a
sar eax, 1
mov ebp, eax
jmp 0x48c706
add ebx, ebx
jne 0x48c706
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x48c6d4
inc ecx
add ebx, ebx
jne 0x48c714
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x48c6d4
add ebx, ebx
jne 0x48c721
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x48c716
jne 0x48c732
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x48c716
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x48c754
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x48c746
jmp 0x48c696
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x48c754
add edi, ecx
jmp 0x48c696
pop esi
mov edi, esi
mov ecx, 0xce
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x48c772
cmp byte [edi], 6
jne 0x48c772
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x48c777
lea edi, [esi + 0x8a000]
mov eax, dword [edi]
or eax, eax
je 0x48c7e6
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xb3cf0]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xb3d2c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x48c7a4
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xb3d30]
or eax, eax
je 0x48c7e0
mov dword [ebx], eax
add ebx, 4
jmp 0x48c7c1
call dword [esi + 0xb3d40]
mov ebp, dword [esi + 0xb3d34]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1f7]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x48c81a
sub esp, 0xffffff80
jmp 0x403861
Function at 0x8f2d12
Capabilities:
Encode data using xor

Disassembly:
dec ebx
dec esp
push edx
test dword [edi + 0x5e7e081b], ebp
inc ecx
push es
xor edx, dword [edx + 0x45]
inc eax
or byte [esp + edi*8 - 0x10], dh
test byte [esi], dh
outsd dx, dword [esi]
ror byte [ecx - 0x55], 0x7c
sahf
outsb dx, byte [esi]
adc al, 0
add byte [eax], al
sbb al, byte [eax]
xor dword ds:[eax], ebp
mov al, byte [0x87871085]
enter 0x6d, 0xffffffffffffffc8
enter 0xffffffffffffbcf6, 0xffffffffffffff8e
add byte [eax], al
sbb al, byte [eax]
out 0xe6, al
xchg dword [eax + 0x61ea5019], ebp
les ecx, [ecx + 0x4a182c00]
je 0x8f2d29
sub ch, byte [eax - 0x35]
or byte [edx + eax + 0x103c12df], 0xd8
cmp al, 0x90
xor esi, dword [ebx + 0x41]
ret

Function at 0x40c630
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0xa000]
push edi
or ebp, 0xffffffff
jmp 0x40c652
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x40c659
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x40c648
mov eax, 1
add ebx, ebx
jne 0x40c66b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x40c660
jne 0x40c67c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x40c660
xor ecx, ecx
sub eax, 3
jb 0x40c690
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x40c702
mov ebp, eax
add ebx, ebx
jne 0x40c69b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x40c6a8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x40c6cc
inc ecx
add ebx, ebx
jne 0x40c6b8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x40c6ad
jne 0x40c6c9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x40c6ad
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x40c6ec
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x40c6dd
jmp 0x40c64e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x40c6ec
add edi, ecx
jmp 0x40c64e
pop esi
lea edi, [esi + 0xa000]
mov eax, dword [edi]
or eax, eax
je 0x40c74b
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xc000]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xc03c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x40c709
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xc040]
or eax, eax
je 0x40c745
mov dword [ebx], eax
add ebx, 4
jmp 0x40c726
call dword [esi + 0xc050]
mov ebp, dword [esi + 0xc044]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1ff]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x40c77f
sub esp, 0xffffff80
jmp 0x40a71c