joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4e3030
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0xdd000]
push edi
or ebp, 0xffffffff
jmp 0x4e3052
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x4e3059
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4e3048
mov eax, 1
add ebx, ebx
jne 0x4e306b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x4e3060
jne 0x4e307c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4e3060
xor ecx, ecx
sub eax, 3
jb 0x4e3090
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x4e3102
mov ebp, eax
add ebx, ebx
jne 0x4e309b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x4e30a8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x4e30cc
inc ecx
add ebx, ebx
jne 0x4e30b8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x4e30ad
jne 0x4e30c9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4e30ad
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x4e30ec
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x4e30dd
jmp 0x4e304e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x4e30ec
add edi, ecx
jmp 0x4e304e
pop esi
mov edi, esi
mov ecx, 0x88
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x4e310a
cmp byte [edi], 3
jne 0x4e310a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x4e310f
lea edi, [esi + 0xe1000]
mov eax, dword [edi]
or eax, eax
je 0x4e3187
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xe7aac]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xe7b40]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x4e313c
mov ecx, edi
jns 0x4e316b
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xe7b48]
or eax, eax
je 0x4e3181
mov dword [ebx], eax
add ebx, 4
jmp 0x4e3159
call dword [esi + 0xe7b44]
mov ebp, dword [esi + 0xe7b4c]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1ff]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x4e31bb
sub esp, 0xffffff80
jmp 0x401a7e

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x40ffd9
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
pushal
call 0x40ffe8
pop dword [ebp - 0x24]
mov eax, 0x2b6ce2d6
sub eax, 0x2b2be2ee
sub dword [ebp - 0x24], eax
push 0x40
push 0x1000
push 0x3dbcc
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x24]
call dword [eax]
mov ecx, 0x4798
xor edx, edx
add edx, eax
mov esi, 0x4a6deab5
sub esi, 0x4a2a96b5
add esi, dword [ebp - 0x24]
mov ebx, 0x11352ddb
add ebx, 0x26e2bfa6
add dword [ebp - 4], 0x8cf63fdc
mov edi, dword [esi]
add dword [ebp - 0x14], 0x40c38c79
sub edi, ebx
sub dword [ebp - 0x18], 0x712f01d6
mov dword [edx], edi
xor dword [ebp - 0x10], 0x7f6f6d03
add edx, 0xc3a8f5ec
sub edx, 0xc3a8f5e8
add esi, 0x3c3849f5
sub esi, 0x3c3849f1
loop 0x41003e
add eax, 0x11133
mov ebx, eax
add eax, 5
mov ecx, 0x3f44526a
sub ecx, 0x3f04526a
add ecx, dword [ebp - 0x24]
call ebx
leave
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x4107e0
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
mov dword [ebp - 8], 0xffffffff
mov dword [ebp - 0xc], 0
jmp 0x410805
mov ecx, dword [ebp - 0xc]
add ecx, 1
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0xc]
cmp edx, dword [ebp + 0xc]
jae 0x410878
mov eax, dword [ebp - 4]
add eax, dword [ebp - 0xc]
movzx ecx, byte [eax]
movzx edx, byte [ebp - 8]
xor ecx, edx
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 8]
shr eax, 8
mov dword [ebp - 8], eax
mov dword [ebp - 0x14], 0
jmp 0x41083a
mov ecx, dword [ebp - 0x14]
add ecx, 1
mov dword [ebp - 0x14], ecx
cmp dword [ebp - 0x14], 8
jge 0x41086d
mov edx, dword [ebp - 0x10]
and edx, 1
neg edx
sbb edx, edx
neg edx
mov byte [ebp - 0x15], dl
mov eax, dword [ebp - 0x10]
shr eax, 1
mov dword [ebp - 0x10], eax
movzx ecx, byte [ebp - 0x15]
test ecx, ecx
je 0x41086b
mov edx, dword [ebp - 0x10]
xor edx, 0xedb88320
mov dword [ebp - 0x10], edx
jmp 0x410831
mov eax, dword [ebp - 8]
xor eax, dword [ebp - 0x10]
mov dword [ebp - 8], eax
jmp 0x4107fc
mov eax, dword [ebp - 8]
not eax
mov esp, ebp
pop ebp
ret
Function at 0x401c57
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
pushal
call 0x401c66
pop dword [ebp - 0x38]
mov eax, 0x401c66
sub dword [ebp - 0x38], eax
mov dword [ebp - 0x48], 0xcdde14f4
add dword [ebp - 0x48], 0x80743057
mov dword [ebp - 0x44], 0xbd4831e
add dword [ebp - 0x44], 0x265ec927
mov dword [ebp - 0x40], 0x7f00c53a
add dword [ebp - 0x40], 0xcd4b7ef4
mov dword [ebp - 0x3c], 0xd3da058a
add dword [ebp - 0x3c], 0x2c25fa76
lea eax, [ebp - 0x48]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x38]
call dword [eax]
mov dword [ebp - 0x48], 0x674e4a5c
add dword [ebp - 0x48], 0xd241efa
mov dword [ebp - 0x44], 0x64a7f0b2
add dword [ebp - 0x44], 0xdcc470c3
mov dword [ebp - 0x40], 0x3ee6e512
add dword [ebp - 0x40], 0x2488875a
mov dword [ebp - 0x3c], 0x97e8fa24
sub dword [ebp - 0x3c], 0x97e8fa24
lea ebx, [ebp - 0x48]
push ebx
push eax
mov eax, 0x4cb710fc
sub eax, 0x4c76e0d0
add eax, dword [ebp - 0x38]
call dword [eax]
push 0x40
push 0x1000
push 0x363de
push 0
call eax
mov ecx, 0x1607a940
add ecx, 0xe9f89dcb
mov edx, eax
mov ebx, 0x64830177
sub ebx, 0x64429177
add ebx, dword [ebp - 0x38]
mov edi, 0x14b9dbff
add edi, 0x7f2f1786
mov dword [ebp - 0xc], 0x78b03887
mov esi, dword [ebx]
add esi, edi
mov dword [ebp - 0x18], 0x9368978b
mov dword [edx], esi
xor dword [ebp - 4], ecx
add edx, 0xde1a6843
sub edx, 0xde1a683f
add ebx, 0x3cb2cec8
add ebx, 0xc34d313c
loop 0x401d7e
add eax, 0xee9476ec
add eax, 0x116c9813
mov ebx, eax
add eax, 0xae7c1d1a
sub eax, 0xae7c1d15
mov ecx, 0x400000
add ecx, dword [ebp - 0x38]
call ebx
leave
ret

Function at 0x401fb2
Capabilities:
Delete file
Move file

Disassembly:
mov ecx, 0x404f28
jmp fcn.0040170c

Function at 0x401ff6
Capabilities:
Check if file exists
Delete directory
Get file attributes

Disassembly:
push esi
mov esi, 0x404f28
push esi
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x402013
push esi
call dword [sym.imp.kernel32.dll_RemoveDirectoryW]
test eax, eax
je 0x402018
push 1
pop eax
pop esi
ret
call fcn.00401fb2
pop esi
ret
Function at 0x101acfc
Capabilities:
Accept command line arguments

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x28
push ebx
push esi
push edi
xor ebx, ebx
xor esi, esi
inc esi
lea eax, [ebp - 8]
push eax
xor edi, edi
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x10], esi
mov dword [ebp - 0xc], ebx
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
cmp dword [ebp - 8], esi
mov dword [ebp - 4], eax
jle 0x101ad5c
mov eax, dword [eax + 4]
cmp word [eax], 0x2f
jne 0x101ad5c
add eax, 2
push eax
call dword [sym.imp.msvcrt.dll__wtol]
mov edi, eax
cmp edi, 7
pop ecx
jl 0x101ad5c
xor edi, edi
mov eax, dword [ebp + 8]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x28]
push eax
push 4
push 0xdd7
push ebx
mov dword [ebp - 0xc], edi
call sub.ntdll.dll_WinSqmAddToStream
cmp dword [ebp - 4], ebx
pop edi
pop esi
pop ebx
je 0x101ad93
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_LocalFree]
xor eax, eax
leave
ret 0xc

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x1001747a
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
pushal
call 0x10017489
pop dword [ebp - 0x34]
mov eax, 0x10017489
sub dword [ebp - 0x34], eax
mov dword [ebp - 0x44], 0x7461450b
sub dword [ebp - 0x44], 0x260effc0
mov dword [ebp - 0x40], 0x17ce98de
add dword [ebp - 0x40], 0x1a64b367
mov dword [ebp - 0x3c], 0x9edb4afb
add dword [ebp - 0x3c], 0xad70f933
mov dword [ebp - 0x38], 0xc6c89aac
sub dword [ebp - 0x38], 0xc6c89aac
lea eax, [ebp - 0x44]
push eax
mov eax, 0x7bebe7b8
sub eax, 0x6be796b4
add eax, dword [ebp - 0x34]
call dword [eax]
mov dword [ebp - 0x44], 0x46681d76
sub dword [ebp - 0x44], 0xd1f5b420
mov dword [ebp - 0x40], 0xa14b4b88
add dword [ebp - 0x40], 0xa02115ed
mov dword [ebp - 0x3c], 0xba0ee507
add dword [ebp - 0x3c], 0xa9608765
mov dword [ebp - 0x38], 0x4e96088f
sub dword [ebp - 0x38], 0x4e96088f
lea ebx, [ebp - 0x44]
push ebx
push eax
mov eax, 0xf041b013
add eax, 0x1fc2a0a5
add eax, dword [ebp - 0x34]
call dword [eax]
push 0x40
push 0x1000
push 0x4a082
push 0
call eax
mov ecx, 0xeb78005f
sub ecx, 0xeb77b9d1
xor ebx, ebx
add ebx, eax
mov edx, 0x41c5ceaa
sub edx, 0x31be7eaa
add edx, dword [ebp - 0x34]
mov edi, 0xc5c35448
add edi, 0xd4789103
add dword [ebp - 0x20], 0xcc871967
mov esi, dword [edx]
mov dword [ebp - 0x24], 0x3a710d38
sub esi, edi
xor dword [ebp - 0x1c], 0x6e3b5743
mov dword [ebx], esi
xor dword [ebp - 0x14], edx
add ebx, 0x92d53b75
sub ebx, 0x92d53b71
add edx, 0x5aa8c17a
add edx, 0xa5573e8a
loop 0x100175a8
add eax, 0x24651b81
add eax, 0xdb9bf18a
mov ebx, eax
add eax, 5
mov ecx, 0x861e04c5
add ecx, 0x89e1fb3b
add ecx, dword [ebp - 0x34]
call ebx
leave
ret

Function at 0x1001bd34
Capabilities:
Log keystrokes

Disassembly:
push ebx
push esi
mov esi, dword [sym.imp.USER32.dll_MapVirtualKeyW]
xor ebx, ebx
push edi
mov edi, ecx
push 5
pop eax
push ebx
mov dword [edi], eax
mov dword [edi + 4], eax
mov word [edi + 8], 1
mov dword [edi + 0x10], ebx
mov dword [edi + 0x14], ebx
mov dword [edi + 0x18], ebx
mov dword [edi + 0x1c], ebx
push 0x5b
mov dword [edi + 0xc], 4
call esi
push ebx
push 0x10
mov byte [edi + 0x29], al
call esi
push ebx
push 0xa0
mov byte [edi + 0x26], al
call esi
push ebx
push 0xa1
mov byte [edi + 0x27], al
call esi
push ebx
push 0x11
mov byte [edi + 0x28], al
call esi
push ebx
push 0x12
mov byte [edi + 0x24], al
call esi
mov byte [edi + 0x25], al
pop edi
pop esi
pop ebx
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x473769
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x477190
cmp edx, dword [eax]
je 0x47378b
add eax, 8
inc ecx
cmp eax, 0x477220
jl 0x47377c
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x477190]
jne 0x4738b9
mov eax, dword [0x477bb0]
cmp eax, 1
je 0x473893
test eax, eax
jne 0x4737bc
cmp dword [0x4770e4], 1
je 0x473893
cmp edx, 0xfc
je 0x4738b9
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4737f3
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.00474670
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.00474490
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x473836
lea eax, [ebp - 0x1a4]
push eax
call fcn.00474490
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x47645c
push edi
call fcn.00474f00
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.00474670
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.00474680
lea eax, [ebp - 0xa0]
push 0x47643c
push eax
call fcn.00474680
push dword [esi + 0x477194]
lea eax, [ebp - 0xa0]
push eax
call fcn.00474680
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.00474e75
add esp, 0x2c
pop edi
jmp 0x4738b9
lea eax, [ebp + 8]
lea esi, [esi + 0x477194]
push 0
push eax
push dword [esi]
call fcn.00474490
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
nop
nop
nop
nop
pop eax
nop
add eax, 0x403d6f
nop
sub eax, 0x403d15
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
cmp ebx, ecx
nop
nop
nop
nop
jl 0x430030
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
nop
nop
jne 0x43001e
nop
nop
nop
nop
popal
nop
jmp fcn.00401219
Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x433002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
mov eax, section..text
mov ebx, 0x40de38
nop
mov ecx, 0x29b8391d
nop
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x43304e
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x433024
mov eax, section..data
nop
mov ebx, 0x4304d8
nop
mov ecx, 0x58844acf
nop
nop
nop
nop
nop
test eax, eax
nop
je 0x433084
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
add eax, 4
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
nop
jne 0x43306c
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0x10005a48
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
pushal
call 0x10005a57
pop dword [ebp - 0x14]
mov eax, 0xf0bcc6e2
add eax, 0x1f439375
sub dword [ebp - 0x14], eax
mov dword [ebp - 0x24], 0x2a88bf36
add dword [ebp - 0x24], 0x23c98615
mov dword [ebp - 0x20], 0x4deac320
add dword [ebp - 0x20], 0xe4488925
mov dword [ebp - 0x1c], 0x9428bff7
sub dword [ebp - 0x1c], 0x47dc7bc9
mov dword [ebp - 0x18], 0x7548a1b0
add dword [ebp - 0x18], 0x8ab75e50
lea eax, [ebp - 0x24]
push eax
mov eax, 0x6aa5814b
add eax, 0xa55b3ed9
add eax, dword [ebp - 0x14]
call dword [eax]
mov dword [ebp - 0x24], 0x61c0c826
add dword [ebp - 0x24], 0x12b1a130
mov dword [ebp - 0x20], 0x746c4d89
add dword [ebp - 0x20], 0xcd0013ec
mov dword [ebp - 0x1c], 0x9be9f1c8
sub dword [ebp - 0x1c], 0x387a855c
mov dword [ebp - 0x18], 0xf1be55cb
sub dword [ebp - 0x18], 0xf1be55cb
lea ebx, [ebp - 0x24]
push ebx
push eax
mov eax, 0xaee4c92d
add eax, 0x611bf6ff
add eax, dword [ebp - 0x14]
call dword [eax]
push 0x40
push 0x1000
push 0x38b92
push 0
call eax
mov ecx, 0x4b05
xor ebx, ebx
add ebx, eax
mov esi, 0xf316dbda
add esi, 0x1ced9826
add esi, dword [ebp - 0x14]
mov edx, 0xf8b191b5
sub dword [ebp - 8], 0x1241984e
mov edi, dword [esi]
add edi, edx
mov dword [ebx], edi
xor dword [ebp - 4], 0x8310dbb3
add ebx, 0x79b44aca
sub ebx, 0x79b44ac6
add esi, 0x49662efe
add esi, 0xb699d106
loop 0x10005b6f
add eax, 0xf56ce2ee
add eax, 0xa943bf9
xor ebx, ebx
add ebx, eax
add eax, 0x86b8719f
add eax, 0x79478e66
mov ecx, 0xea5c1de6
sub ecx, 0xda5c1de6
add ecx, dword [ebp - 0x14]
call ebx
leave
ret
Function at 0x9494b0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x20c000]
lea eax, [edi + 0x27b9c4]
push dword [eax]
mov dword [eax], 0xe85d6de0
push eax
push edi
jmp 0x9494da
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x9494e1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x9494d0
mov eax, 1
add ebx, ebx
jne 0x9494f3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x949504
jne 0x949523
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x949523
dec eax
add ebx, ebx
jne 0x949510
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x9494e8
add ebx, ebx
jne 0x94951f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x949575
xor ecx, ecx
sub eax, 3
jb 0x94953b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x9495aa
sar eax, 1
mov ebp, eax
jmp 0x949546
add ebx, ebx
jne 0x949546
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x949514
inc ecx
add ebx, ebx
jne 0x949554
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x949514
add ebx, ebx
jne 0x949561
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x949556
jne 0x949572
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x949556
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x949594
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x949586
jmp 0x9494d6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x949594
add edi, ecx
jmp 0x9494d6
pop esi
pop edi
pop eax
mov dword [edi], eax
mov edi, esi
mov ecx, 0x136b0
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x9495b6
cmp byte [edi], 0x39
jne 0x9495b6
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x9495bb
lea edi, [esi + 0x52f000]
mov eax, dword [edi]
or eax, eax
je 0x949633
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x54b63c]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x54b738]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x9495e8
mov ecx, edi
jns 0x949617
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x54b740]
or eax, eax
je 0x94962d
mov dword [ebx], eax
add ebx, 4
jmp 0x949605
call dword [esi + 0x54b73c]
mov ebp, dword [esi + 0x54b744]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x31f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x949667
sub esp, 0xffffff80
jmp 0x4014c4
Function at 0x44fee0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0x14]
push edi
mov edi, dword [esp + 0x14]
test edi, edi
je 0x44ff30
mov bl, byte [edi]
movzx ecx, bl
mov eax, ecx
shl eax, 4
sub eax, ecx
add eax, eax
test bl, bl
je 0x44ff1d
mov edx, eax
lea edi, [edi + 1]
mov ecx, eax
shl edx, 5
shr ecx, 3
add edx, ecx
movsx ecx, bl
mov bl, byte [edi]
add edx, ecx
xor eax, edx
test bl, bl
jne 0x44ff01
mov ecx, eax
mov edx, eax
shr ecx, 3
shl edx, 5
add ecx, 0x3a
add ecx, edx
xor eax, ecx
jmp 0x44ff3c
movzx ecx, byte [esi]
mov eax, ecx
shl eax, 4
sub eax, ecx
add eax, eax
test esi, esi
je 0x44ff62
mov bl, byte [esi]
test bl, bl
je 0x44ff62
mov edx, eax
lea esi, [esi + 1]
mov ecx, eax
shl edx, 5
shr ecx, 3
add edx, ecx
movsx ecx, bl
mov bl, byte [esi]
add edx, ecx
xor eax, edx
test bl, bl
jne 0x44ff46
mov esi, dword [esp + 0x1c]
mov edx, eax
mov ecx, eax
shl edx, 5
shr ecx, 3
add edx, ecx
xor eax, edx
test esi, esi
je 0x44ffad
mov bl, byte [esi]
test bl, bl
je 0x44ff9c
nop
mov edx, eax
lea esi, [esi + 1]
mov ecx, eax
shl edx, 5
shr ecx, 3
add edx, ecx
movsx ecx, bl
mov bl, byte [esi]
add edx, ecx
xor eax, edx
test bl, bl
jne 0x44ff80
mov ecx, eax
mov edx, eax
shr ecx, 3
shl edx, 5
add ecx, 0x3a
add ecx, edx
xor eax, ecx
mov esi, dword [esp + 0x20]
test esi, esi
je 0x44ffdc
mov bl, byte [esi]
test bl, bl
je 0x44ffdc
nop dword [eax + eax]
mov edx, eax
lea esi, [esi + 1]
mov ecx, eax
shl edx, 5
shr ecx, 3
add edx, ecx
movsx ecx, bl
mov bl, byte [esi]
add edx, ecx
xor eax, edx
test bl, bl
jne 0x44ffc0
mov esi, dword [esp + 0x24]
mov edx, eax
mov ecx, eax
shl edx, 5
shr ecx, 3
add edx, ecx
xor eax, edx
test esi, esi
je 0x450025
mov bl, byte [esi]
test bl, bl
je 0x450014
mov edx, eax
lea esi, [esi + 1]
mov ecx, eax
shl edx, 5
shr ecx, 3
add edx, ecx
movsx ecx, bl
mov bl, byte [esi]
add edx, ecx
xor eax, edx
test bl, bl
jne 0x44fff8
mov ecx, eax
mov edx, eax
shr ecx, 3
shl edx, 5
add ecx, 0x3a
add ecx, edx
xor eax, ecx
mov esi, dword [esp + 0x28]
test esi, esi
je 0x45004f
mov bl, byte [esi]
test bl, bl
je 0x45004f
mov edx, eax
lea esi, [esi + 1]
mov ecx, eax
shl edx, 5
shr ecx, 3
add edx, ecx
movsx ecx, bl
mov bl, byte [esi]
add edx, ecx
xor eax, edx
test bl, bl
jne 0x450033
mov ecx, dword [esp + 0x10]
xor edx, edx
pop edi
pop esi
pop ebx
div dword [ecx + 4]
mov eax, edx
ret