joyce8/EMBER2024-capa huggingface dataset:
Function at 0x409ff8
Capabilities:
Hash data using murmur3

Disassembly:
dec eax
inc eax
add ecx, edx
neg eax
mov dword [0x40fc94], 0x7b89398
ror esi, 0x16
add edx, eax
sub eax, esi
push 0x40
call fcn.00405993
xor ecx, esi
sub ebx, dword [0x40fe94]
ror esi, 4
inc ecx
mov dword [0x40f9dd], ecx
sub ebx, dword [0x40ff24]
inc dword [eax]
ror eax, 0xd
xor esi, edx
xor esi, dword [0x40fde5]
xchg eax, esi
xor eax, 0x3144d6a
call fcn.00408750
xor edi, dword [0x40ff19]
xchg esi, edx
ror esi, 0x14
xchg edx, esi
sub ecx, dword [0x40fd24]
sub esi, 0x2886c72
ror ecx, 0x10
inc esi
mov dword [0x40fbad], ecx
or dword [0x40f9c6], esi
dec esi
rol ecx, 0x10
add esi, 0x2886c72
xchg edx, esi
rol esi, 0x14
xchg esi, edx
call fcn.00405074
xor eax, 0x3144d6a
xchg eax, esi
xor esi, edx
rol eax, 0xd
mov dword [0x40fc7f], ecx
dec ecx
rol esi, 4
xor ecx, esi
call fcn.00405993
push 0x3000
call fcn.00405993
xor ecx, dword [0x40fdf5]
call fcn.004062d0
xchg esi, eax
add eax, ecx
sub dword [0x40fa40], 0x85134c
call fcn.0040690f
dec edx
xor ecx, eax
not edx
ror eax, 0xe
add dword [0x40fbc4], 0x6f3479a
xor edx, ecx
xor ebx, dword [0x40fdb9]
call fcn.00405993
xchg edx, eax
xchg edx, eax
call fcn.00405074
xor edx, ecx
or dword [0x40fa99], 0x5f099ca
rol eax, 0xe
not edx
xor ecx, eax
inc edx
call fcn.00405074
mov dword [0x40fc85], 0xd8abc75
sub eax, ecx
xchg esi, eax
call fcn.00405074
call fcn.00405993
push 0x927
sub esi, eax
xor esi, edx
or dword [0x40fb1e], 0x23e7cf7
sub dword [0x40facf], ebx
xor edx, 0x2bb01710
sub esi, eax
dec esi
rol esi, 5
add edx, eax
add dword [0x40fae5], esi
rol eax, 0x19
xor esi, eax
call fcn.00406cc3
or dword [0x40fadd], 0x6046720
sub esi, eax
not esi
not esi
add esi, eax
add dword [0x40fa7b], 0x283708f5
call fcn.00405074
xor esi, eax
ror eax, 0x19
xor dword [0x40fa2b], esi
sub edx, eax
ror esi, 5
inc esi
add esi, eax
xor edx, 0x2bb01710
or dword [0x40fafa], 0xf7d44c0
xor esi, edx
add esi, eax
push 0
xor dword [0x40fa63], edx
call fcn.00405074
xchg esi, eax
xor edx, 0x3090d80

Function at 0x40adbb
Capabilities:
Encode data using xor

Disassembly:
stc
and byte [edi], ah
arpl word [ebp + 0x63], bx
push ds
in eax, 0xb
add bh, cl
dec edi
sar byte [edi], 1
int 0xe2
dec esp
push ebx
adc esp, edi
push ecx
out 0xd6, al
push ds
xor dword [ebx + 0x53673711], edx
sti
into
mov bl, 0x16
in eax, 0x3c
jcxz 0x40ad6f
pop ss
sbb al, 0x94
or dword [edi], esi
pop ebx
iretd
xchg esp, eax
adc esp, dword [edi - 0x842ea02]
fadd st(0)
rol byte [edx - 0x5ce89664], 0xc
pop esp
jnp 0x40ad0a
push ds
bound esp, qword [ebx + 0x14]
xchg esi, eax
imul edx, edx, 0xffffffcc
jns 0x40ad5f
xor ebx, dword [ebx + edx*4 + 0x10]
dec edi
dec ebx
aas
fsub dword [esi - 0x409bae4a]
mov eax, 0xa1c8fc1f
out dx, eax
jg 0x40ada9
mov bl, 0x3e
and ch, byte [ecx + edx - 0x13c90bb1]
in eax, dx
inc esp
dec ebx
push ebx
fdivr dword [esi + 0x58fe5a2]
pop edx
wait
adc eax, 0x2dd8114e
mov edi, 0xd4ffb04f
cmp eax, dword [eax]
dec edi
aad 0xe2
out 0xff, eax
sbb al, 0x7c
sar bl, cl
xor dword [eax - 0x76e315f4], edx
dec ebx
lodsb al, byte [esi]
imul ebx, dword [ebp + 0x60], 0x7e26e679
sub byte [ecx + 0x6f], 0x2b
add dh, al
das
invalid
Function at 0x40bf68
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [0x40f784]
push edi
mov edi, edx
test edi, edi
je 0x40bfb7
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x40bfb6
and dword [ebp - 4], 0
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileType]
and eax, 0xffff7fff
cmp eax, 2
lea eax, [ebp - 4]
push 0
push eax
jne 0x40bfaa
push esi
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_WriteConsoleW]
jmp 0x40bfb6
lea eax, [esi + esi]
push eax
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
pop edi
pop ebx
leave
ret 4

Function at 0x40c8bb
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x40f394]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
cmp ax, word [0x40f9c4]
jne 0x40c957
push edi
lea eax, [ebp - 0x10]
mov dword [ebp - 0x14], 6
push eax
push 1
xor edi, edi
push edi
push 0x405368
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40c956
push esi
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0xc]
push eax
push edi
push edi
push 0x405420
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x10]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
pop esi
jne 0x40c956
push 3
push dword [edi*8 + 0x401798]
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.msvcrt.dll__wcsnicmp]
add esp, 0xc
test eax, eax
je 0x40c948
inc edi
cmp edi, 0x1c
jb 0x40c926
jmp 0x40c956
mov ax, word [edi*8 + 0x40179c]
mov word [0x40f9c4], ax
pop edi
mov ecx, dword [ebp - 4]
mov ax, word [0x40f9c4]
xor ecx, ebp
call fcn.00408f40
leave
ret
Function at 0x42e006
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
mov eax, section..text
nop
nop
nop
nop
push 4
nop
nop
nop
nop
nop
pop edi
nop
nop
cmp eax, 0
nop
nop
je 0x42e072
nop
nop
nop
nop
mov ebx, 0x407ef8
nop
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
xchg ecx, eax
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x44a505b3
nop
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
loop 0x42e060
nop
nop
nop
mov eax, section..data
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x42e0d2
mov ebx, 0x42cd70
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x33754a2c
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x42e0c0
nop
nop
nop
nop
popal
nop
jmp 0x401219
Function at 0x40af00
Capabilities:
Encode data using xor

Disassembly:
sbb dword [esi - 0xe], ecx
cmp ah, dl
imul eax, dword [edx + 0x54fa5337], 0xffffffc9
and eax, 0x47
jge 0x40af61
dec eax
mov al, byte [0xfd262b44]
aas
xchg edx, eax
sub esi, dword [edx - 0x54]
cvttps2pi mm1, qword [esi - 0x2b]
test dword [ecx - 0x5fe6b1c4], 0xf760d42e
dec ebx
stosb byte es:[edi], al
jns 0x40afe9
cmp eax, edx
sbb al, 0x6c
sub byte [edx], ah
mov ebp, 0xab99e8a
and dword [ebp - 0x6c], 0x39
pop edx
movsd dword es:[edi], dword [esi]
sar dword [edx], 1
cmp bh, byte ss:[edi + 0x38]
mov ecx, 0x813a86b4
cmp byte [ecx - 0x7ec5794c], bh
sbb esi, dword [ebx]
xchg ebx, eax
inc edx
dec edi
sahf
adc dword [ecx], 0x46
cmpsd dword [esi], dword es:[edi]
pop es
push 0xffffffffffffff8a
inc esp
push esp
push 0xffffffffffffff82
push 3
bound edi, qword [esi - 0x23]
jns 0x40af85
sbb al, 0xd8
mov ebx, 0x62c22dda
sbb ebp, eax
cmp al, 0x55
xchg esi, eax
clc
and al, 0x23
push ebx
test byte [edx + 0xe], 0x9d
and al, 0x7c

Function at 0x41658b
Capabilities:
Encode data using xor

Disassembly:
xchg esp, eax
invalid
mov al, byte [0x8b78eb0f]
mov bl, 0x11
mov ch, 0x8f
pop ss
rcl byte [edi]
mov al, dl
popfd
je 0x416502
or dh, byte [eax + 0x3c5a4535]
xor byte [ebx], 0x8c
jecxz 0x41657d
invalid
imul esp, dword [ebx + 0x31a1230d], 0x8602766d
pop ds
mov ss, word [esi + 0x2a53b75e]
scasd eax, dword es:[edi]
lds edi, [ebx]
xchg ecx, eax
stosd dword es:[edi], eax
movsb byte es:[edi], byte [esi]
sub byte [ebp + eax*4 + 0x79ff182a], cl
test dword [edx], ebp
sbb bh, bh
jns 0x41653f
test dword [edx], ebp
sbb bh, bh
jns 0x41653f
test eax, 0x2dc7c768
neg byte [edx - 0x1cdd0b65]
xchg ebp, eax
sal dword [ecx - 0x29], cl
clc
sub dword [0x95690cb3], 0xc38878e3
or dword [edx + 0x42], ebp
add edi, edi
in eax, 0xed
add cl, byte [ecx + 0x6cd181ad]
aaa
loope 0x416628
in eax, 0xac
add eax, 0x526c1e81
mov dh, 0xc2
jb 0x416571
push eax
and dword [0x3d6c7b4a], ebx
fistp word [edx]
xchg ecx, eax
imul al
shl dword [eax], cl
stosd dword es:[edi], eax
mov dword [edx + 0x47], edi
popfd
cmp dh, byte [ecx]
test al, 5
cld
insb byte es:[edi], dx
test al, 0x99
loope 0x416586
add eax, 0x99a86cfc
push 0x7c81b6f9
dec ax
cmp esp, esp
mov ah, 0x4c
inc esp
call dword [ecx]
add edx, dword [edi]
mov byte [0x182d8b2], al
outsb dx, byte [esi]
cdq
wait
aad 0xf2
xchg esi, eax
xor dh, dl
jp 0x4165dc
mov edx, dword [ebx]
retf 0xba06
mov word [edx + 3], fs
add bl, byte [esi + 0x2c]
in eax, dx
pop ebx
add al, byte [ebp + 0x50]
dec ebp
lcall 0xd6be, 0x14e1bc0d
sub eax, 0xf7710a88
hlt
Function at 0x417a10
Capabilities:
Get common file path

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x50
test eax, eax
push esi
je 0x417a36
mov eax, dword [0x6357d0]
test eax, eax
push ebx
push edi
lea eax, [esp + 0xc]
push 0x50
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov edi, str.dsound.dll
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0xd]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea eax, [esp + 0xc]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
pop edi
mov dword [0x6357d0], eax
test eax, eax
pop ebx
je 0x417ad1
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.DirectSoundCreate
push eax
call esi
mov ecx, dword [0x6357d0]
rcl byte [edi + 0x63]
add byte [eax + 0x64], ch
and byte [ebx], ah
push ecx
mov dword [0x6357cc], eax
call esi
mov ecx, dword [0x6357cc]
mov dword [0x6357d4], eax
test ecx, ecx
je 0x417ac7
test eax, eax
je 0x417ac7
mov eax, 1
pop esi
add esp, 0x50
ret
mov dword [0x6357d0], 0
xor eax, eax
pop esi
add esp, 0x50
ret

Function at 0x4299c6
Capabilities:
Encode data using xor

Disassembly:
mov bl, 0xc7
fucompi st(5)
wait
or dl, byte [edi*4 + 0x6574ed4b]
je 0x4299ce
jo 0x429997
shl byte [ecx - 0x44], cl
ja 0x429970
jno 0x429967
into
mov al, 0x2e
xchg dl, cl
jp 0x42997b
cmp dword [0xc472b7cc], ecx
or eax, 0xc472b7cc
call 0xbcd010eb
insb byte es:[edi], dx
test byte [esi - 0x60b6d61e], ah
in eax, dx
fisttp dword [ebp + eax - 0x178ca9e1]
ljmp 0xa417
fistp dword [ebp + 0x7924a417]
pop esi
int 0x98
push es
push ecx
mov cl, 0x53
and al, 0xbc
sub ebp, dword [eax - 0x21]
push 0xffffffffffffffba
fild qword [edx - 0x46]
imul ecx, ebx, 0x25
das
and al, 0x68
fst dword [edi + 0x391cf161]
sbb eax, 0xaf51c210
xchg edi, eax
adc al, 0x83
or dword [esi], 0xffffffe3
mov esp, 0xd189ac93
rol dword [eax*2 - 0x6f802bcc], 1
rol dword [eax*2 - 0x6f802bcc], 1
xchg ebx, eax
pop ebx
and dword [edi], esp
aam 0xf3
test eax, 0x20e7bada
scasd eax, dword es:[edi]
insd dword es:[edi], dx
cmp eax, 0x1a0d2e23
and dword [0x5bc55a25], ebx
out 0xf7, eax
sub byte [ecx], al
cmp al, 0xa8
sbb eax, 0x73bffed1
push esi
sub byte [edi - 0x2c7a20b5], al
mov dl, 0x81
lodsd eax, dword [esi]
xor al, byte [ebx + ebx*2]
cmp al, 0xac
jo 0x4299a8
fimul word [esi + 0x1b550bb4]
sbb ch, byte [eax - 0x27fe62e2]
cmp byte [edi], ch
xchg dword [ebx - 0x60573a9f], ebp
fisubr dword [ebp - 0x66]
insd dword es:[edi], dx
xchg byte [ebp - 0x21], ch
adc ah, byte [0xf60c4759]
enter 0xffffffffffffbe3d, 0xffffffffffffffdb
sub cl, al
enter 0x51ff, 0xffffffffffffffdd
jle 0x429a89
pop esi
invalid
inc ebp
jb 0x429a19
imul ebx, dword [edx - 0x34], 0xffffffd8
movsb byte es:[edi], byte [esi]
dec ebx
fmul qword [ebp + 0x34c2ede3]
das
mov dl, byte [ebx]
outsb dx, byte [esi]
cwde
sbb eax, 0xdc6c76c2
sti
and dword [ebx], edx
fstp xword [edi + ebx - 0x2876f733]
sbb eax, 0x4a84b378
adc dword [ecx + 0x708c9b24], 0x3a
aaa
into
push edx
insd dword es:[edi], dx
push esi
push eax
adc dword [edx - 0x52a5bd58], ebp
retf 0x9e77
Function at 0x468bcc
Capabilities:
Encode data using xor

Disassembly:
xchg esp, eax
imul edi, ecx, 0xacc74c84
sbb byte [edi + 9], ah
pop ebp
invalid

Function at 0x47ff3c
Capabilities:
Encode data using xor

Disassembly:
xlatb
cmp byte [ebx], 0xb9
jnp 0x47ff99
salc
jmp 0x13353fae
js 0x47ff99
add eax, 0x47bea644
inc ecx
mov eax, 0x14ec0b6b
pop ebx
imul ecx, dword [ebx], 0xffffffec
adc al, 0x5b
in al, dx
xor eax, 0xa3c2ee3a
lds ebp, [edi + 0x25]
loop 0x47ffa2
push 0x9ec57939
leave
mov ecx, 0xeea71bff
rcr dword [edi + 0x1ea794fa], 0xcd
mov dword [edx - 0x7d], ebx
mov al, 0x68
mov ch, 0x2a
jmp 0x47ffe5
into
int1
pop esp
test dword [ecx], 0xc671b7b0
popal
jmp 0x480027
in al, dx
lodsd eax, dword [esi]
fiadd word [ecx - 0x688ad01f]
invalid

Function at 0x496a27
Capabilities:
Encode data using xor

Disassembly:
sub eax, 0xaf76341
in eax, 0xe1
dec eax
lcall 0x42e9, 0xca0f743c
jg 0x496a18
invalid
cmp al, 0xb0
xchg byte [ebx], dh
xor edi, edx
clc
pop ebx
ror byte [edi + 0x25], 0x34
xor al, 0xf5
in al, 0xaf
int3
mov esp, 0x8e72ed4b
ror dword [edi], 1
invalid
les ebx, [ebx - 0x7c]
scasb al, byte es:[edi]
add al, 0x39
or edi, dword [edi]
cmc
inc ebp
cmc
sbb eax, 0x84b8eac5
jp 0x4969e4
jp 0x496a66
fisubr dword [ecx + 0x6cfaae78]
invalid
pop edx
ja 0x496a2a
in eax, dx
and eax, 0xa53fd80d
stc
jno 0x496a04
clc
stosb byte es:[edi], al
wait
insd dword es:[edi], dx
jmp 0x24ef96da
bound ecx, qword [ebx + 0x62f8aa9d]
fisub dword [eax + 0x69c50a34]
mov es, word [edx - 0x3407d1fc]
lds ebp, [edx - 0x59919f08]
sbb edi, dword [eax]
sbb dword [edi + 0x5b9c6f4e], esi
stosb byte es:[edi], al
clc
invalid
pop ebx
fcomp dword [ebx]
rcl dword [esi], cl
in eax, 0x94
adc bh, byte [edx + 0x64]
jge 0x496a69
mov bh, 0x21
add dword [ebx], eax
idiv cl
mov al, 0xc5
mov edx, 0x2b64b724
xchg esp, eax
push 0xffffffffffffffd4
xor esp, ebp
stosb byte es:[edi], al
test bh, dh
mov ebx, 0x21ebdeab
jnp 0x496a85
jo 0x496a4e
imul eax, dword [esi], 0xfffffff0
clc
imul esi, dword [edx - 4], 0x64
call 0xbf2d968d
or ch, byte [ebx - 0x4d1ad0e8]
fsub qword [edi - 0x63957c28]
rcr dword [ebx], 1
loopne 0x496b4b
stosd dword es:[edi], eax
arpl word [edx + 0x5aa45db], bx
test al, 0xd4
xlatb
scasd eax, dword es:[edi]
ljmp 0x9d09
mov al, byte [0x68d08c31]
aas
invalid
Function at 0x4abc40
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push ebp
push esi
push es
enter 0x957, 0x5c
jb 0x4abcb0
pop es
inc edi
or ah, bh
add dword [eax - 0xc], edx
push edx
push edx
jbe 0x4abc74
mov esp, 0x903ea702
movsd dword es:[edi], dword es:[esi]
jmp 0x4abcb1
pop ecx
pop es
push edi
pop es
inc esp
int3
rol ebp, 0x92
xchg esp, eax
and eax, 0xa0859e88
pop fs
ret
cli
mov edi, dword [ecx + 0x7fc047a3]
movsb byte es:[edi], byte [esi]
xlatb
add bh, ah
loope 0x4abcbe
xchg ecx, eax
adc bl, ch
jge 0x4abd11
push ebp
and eax, 0x21d20fea
aaa
dec ebp
cmpsd dword [esi], dword es:[edi]
xor dword [ebp - 0x412078df], edi
push eax
js 0x4abd0c
aam 1
div dword [edi + 0x53]
scasb al, byte es:[edi]
jnp 0x4abd2b
jecxz 0x4abca7
ficomp word [edi]
invalid
mov eax, 0x2ec3732
mov ebp, 0x66363
xor al, byte [0xa894024d]
add byte [edx], dh
add eax, 0xa894024d
je 0x4abca3
cmpsb byte [esi], byte es:[edi]
push dword [ebx - 0x19]
mov byte [0x3f3310bc], al
je 0x4abd2b
cmovnp edx, dword [esi + 0x53]
dec ebx
push esi
push ebx
push esi
enter 0xffffffffffffac57, 0x36
dec esi
adc eax, 0x8e61effd
mov cl, 0x51
fnstcw word [edx]
mov word [ebx], ss
insb byte es:[edi], dx
test byte [ebp - 0x1c], ah
inc edi
leave
adc eax, 0x48d6e3e4
jge 0x4abd5c
bound esi, qword [ebx]
xchg ecx, eax
adc esi, dword [edx + 0x79713c37]
jno 0x4abd15
inc edi
push edx
invalid
aad 0x94
invalid
Function at 0x4ca771
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
add ebp, 4
sub ebp, 4
xchg dword [esp], ebp
pop esp
mov dword [esp], esi
mov esi, esp
add esi, 4
sub esi, 4
xchg dword [esp], esi
pop esp
mov dword [esp], ebp
mov dword [esp], ebx
push 0x33bb7d53
mov dword [esp], ebx
mov dword [esp], ecx
push dword [esp]
pop ebx
add esp, 4
mov ebx, dword [esp]
push ecx
mov ecx, esp
push ebx
mov ebx, 0x2ffd7450
add ebx, 0xd0028bb4
add ecx, ebx
pop ebx
add ecx, 4
sub esp, 4
mov dword [esp], ecx
push dword [esp + 4]
pop ecx
pop dword [esp]
pop esp
push ecx
mov ecx, 0x3c
add ecx, edx
push 0x6945618c
mov dword [esp], edx
mov edx, 0
add edx, 0x7d7d4bd8
add edx, ecx
sub edx, 0x7d7d4bd8
push ebx
mov ebx, 0
add ebx, edx
add eax, dword [ebx]
pop ebx
pop edx
pop ecx
sub esp, 4
mov dword [esp], ebx
push eax
mov eax, 0xb9a69f3
mov dword [esp + 4], eax
pop eax
mov dword [esp], edi
mov dword [esp], edx
sub esp, 4
mov dword [esp], ecx
push dword [esp]
mov edx, dword [esp]
add esp, 4
add esp, 4
mov edx, dword [esp]
push esi
mov esi, esp
add esi, 4
push edx
push 4
mov edx, dword [esp]
add esp, 4
add esi, edx
pop edx
xchg dword [esp], esi
pop esp
jmp 0x5000a7
push esi
mov dword [esp], ebp
mov ebp, esp
push edi
mov edi, 0x7ff73755
shl edi, 5
neg edi
sub edi, 0x119155c
add ebp, edi
pop edi
sub ebp, 4
xchg dword [esp], ebp
mov esp, dword [esp]
mov dword [esp], edx
push ecx
mov ecx, esp
add ecx, 4
push ebx
mov ebx, 4
sub ecx, ebx
pop ebx
push ecx
push dword [esp + 4]
pop ecx
pop dword [esp]
pop esp
mov dword [esp], ecx
pop edx
push dword [esp]
mov edx, dword [esp]
add esp, 4
push esi
mov esi, esp
add esi, 4
push edi
mov edi, 4
add esi, edi
pop edi
xchg dword [esp], esi
pop esp
push ebp
push esp
pop ebp
add ebp, 4
sub ebp, 4
xchg dword [esp], ebp
pop esp
mov dword [esp], ebx
mov dword [esp], eax
pop dword [ebp - 4]
push ecx
mov ecx, esp
push esi
mov esi, 0x4ef67082
inc esi
neg esi
push ecx
mov ecx, 0x29f716b9
not ecx
add ecx, 0xdb00a633
sub esi, ecx
pop ecx
add ecx, esi
pop esi
sub ecx, 4
push ecx
push dword [esp + 4]
pop ecx
pop dword [esp]
pop esp
mov dword [esp], eax
sub esp, 4
mov dword [esp], edx
mov dword [esp], ebx
mov eax, dword [esp]
push ebx
mov ebx, esp
add ebx, 4
add ebx, 4
xchg dword [esp], ebx
pop esp
push dword [esp]
pop eax
push esi
mov esi, esp
add esi, 4
push ebx
mov ebx, 4
add esi, 0x23fb7099
add esi, ebx
sub esi, 0x23fb7099
pop ebx
xchg dword [esp], esi
pop esp
jmp fcn.0058debe
Function at 0x628421
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x6323a8
cmp edx, dword [eax]
je 0x628443
add eax, 8
inc ecx
cmp eax, 0x632438
jl 0x628434
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x6323a8]
jne 0x628571
mov eax, dword [0x636d7c]
cmp eax, 1
je 0x62854b
test eax, eax
jne 0x628474
cmp dword [0x6322d0], 1
je 0x62854b
cmp edx, 0xfc
je 0x628571
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x6284ab
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.00628e00
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.00629290
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x6284ee
lea eax, [ebp - 0x1a4]
push eax
call fcn.00629290
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x62dd54
push edi
call fcn.0062b160
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.00628e00
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.00628e10
lea eax, [ebp - 0xa0]
push 0x62dd34
push eax
call fcn.00628e10
push dword [esi + 0x6323ac]
lea eax, [ebp - 0xa0]
push eax
call fcn.00628e10
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.0062b0d4
add esp, 0x2c
pop edi
jmp 0x628571
lea eax, [ebp + 8]
lea esi, [esi + 0x6323ac]
push 0
push eax
push dword [esi]
call fcn.00629290
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0xe7ba00
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0xa58000]
push edi
jmp 0xe7ba1a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0xe7ba21
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xe7ba10
mov eax, 1
add ebx, ebx
jne 0xe7ba33
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0xe7ba44
jne 0xe7ba63
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xe7ba63
dec eax
add ebx, ebx
jne 0xe7ba50
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0xe7ba28
add ebx, ebx
jne 0xe7ba5f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0xe7bab5
xor ecx, ecx
sub eax, 3
jb 0xe7ba7b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0xe7baea
sar eax, 1
mov ebp, eax
jmp 0xe7ba86
add ebx, ebx
jne 0xe7ba86
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xe7ba54
inc ecx
add ebx, ebx
jne 0xe7ba94
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xe7ba54
add ebx, ebx
jne 0xe7baa1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0xe7ba96
jne 0xe7bab2
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0xe7ba96
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0xe7bad4
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0xe7bac6
jmp 0xe7ba16
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0xe7bad4
add edi, ecx
jmp 0xe7ba16
pop esi
mov edi, esi
mov ecx, 0xbee
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0xe7baf2
cmp byte [edi], 6
jne 0xe7baf2
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0xe7baf7
lea edi, [esi + 0xa79000]
mov eax, dword [edi]
or eax, eax
je 0xe7bb66
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xa9831c]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xa983b8]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0xe7bb24
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xa983c0]
or eax, eax
je 0xe7bb60
mov dword [ebx], eax
add ebx, 4
jmp 0xe7bb41
call dword [esi + 0xa983bc]
mov ebp, dword [esi + 0xa983c4]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x21f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0xe7bb9a
sub esp, 0xffffff80
jmp 0x419acc
Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
push 4
nop
nop
nop
nop
nop
nop
nop
pop edi
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x433072
nop
nop
mov ebx, 0x40de38
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
nop
sub ecx, eax
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
nop
push eax
mov eax, ecx
nop
nop
nop
nop
nop
nop
nop
div edi
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x47fa3a3b
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x433060
nop
mov eax, section..data
nop
nop
nop
cmp eax, 0
nop
nop
je 0x4330d2
nop
nop
nop
mov ebx, 0x4304d8
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x69d863a6
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x4330c0
nop
popal
nop
nop
nop
nop
jmp 0x431219