joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44ccc0
Capabilities:
Check mutex on windows
Create thread

Disassembly:
push 0xffffffffffffffff
push 0x4731ad
mov eax, dword fs:[0]
push eax
sub esp, 0x584
mov eax, dword [0x48a348]
xor eax, esp
mov dword [esp + 0x580], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x48a348]
xor eax, esp
push eax
lea eax, [esp + 0x598]
mov dword fs:[0], eax
call fcn.0043c820
push str..winvnc.cpp_:__DBG___WinVNCAPPMain_n
mov ecx, 9
mov eax, 0x48c4e8
call fcn.00401000
add esp, 4
push 4
call fcn.0045dd59
xor ebp, ebp
add esp, 4
cmp eax, ebp
je 0x44cd31
mov edi, eax
mov dword [eax], ebp
mov dword [esp + 0x14], edi
jmp 0x44cd37
mov dword [esp + 0x14], ebp
mov edi, ebp
push str.WinVNC_Win32_Instance_Mutex
push ebp
push ebp
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov dword [edi], eax
cmp eax, ebp
je 0x44cd57
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x44cd70
push ebp
push 0x47d010
push 0x4a73b8
push ebp
call dword [sym.imp.USER32.dll_MessageBoxA]
xor eax, eax
jmp 0x44ceea
lea esi, [esp + 0x1c]
call fcn.00443f80
mov dword [esp + 0x5a0], ebp
mov eax, dword [esp + 0xe0]
cmp eax, ebp
je 0x44cd9b
push eax
call fcn.0045ecd6
add esp, 4
mov dword [esp + 0xe0], ebp
push 0x47d010
call fcn.0045f17a
add esp, 4
mov dword [esp + 0xe0], eax
push str..winvnc.cpp_:_server_created_ok_n
xor ecx, ecx
mov eax, 0x48c4e8
call fcn.00401000
mov eax, dword [0x4a782c]
add esp, 4
push str.GlobalSessionEventUltra
push ebp
push 0x1f0003
mov dword [esp + 0x580], eax
call dword [sym.imp.KERNEL32.dll_OpenEventA]
mov dword [0x4a7830], eax
cmp eax, ebp
je 0x44cdf0
push eax
call dword [sym.imp.KERNEL32.dll_ResetEvent]
push str..winvnc.cpp_:__SDEvent_created__n
xor ecx, ecx
mov eax, 0x48c4e8
call fcn.00401000
add esp, 4
push str..winvnc.cpp_:__Init_SDTimer_n
xor ecx, ecx
mov eax, 0x48c4e8
mov dword [0x4a7334], 0xffffffff
call fcn.00401000
add esp, 4
push 1
push ebp
push 0x44cc80
push ebp
push 0x7d0
call dword [sym.imp.WINMM.dll_timeSetEvent]
cmp byte [0x4a77f3], 0
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x4a7334], eax
jne 0x44ce9a
mov edi, dword [sym.imp.KERNEL32.dll_CreateThread]
mov ebp, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea ecx, [esp + 0x18]
push ecx
push 0
lea edx, [esp + 0x24]
push edx
push 0x44c8d0
push 0
push 0
call edi
mov esi, eax
push 0xffffffffffffffff
push esi
call ebp
push esi
call ebx
push str..winvnc.cpp_:__Closing_Imp_Thread_n
xor ecx, ecx
mov eax, 0x48c4e8
call fcn.00401000
add esp, 4
cmp byte [0x4a77f3], 0
je 0x44ce56
mov edi, dword [esp + 0x14]
xor ebp, ebp
mov eax, dword [edi]
cmp eax, ebp
je 0x44cea7
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push edi
call fcn.0045dc91
mov eax, dword [0x4a7830]
add esp, 4
cmp eax, ebp
je 0x44cebc
push eax
call ebx
push str..winvnc.cpp_:__SHUTING_DOWN_SERVER__n
xor ecx, ecx
mov eax, 0x48c4e8
call fcn.00401000
add esp, 4
lea eax, [esp + 0x1c]
push eax
mov dword [esp + 0x5a4], 0xffffffff
call fcn.00444230
mov eax, 1
mov ecx, dword [esp + 0x598]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x580]
xor ecx, esp
call fcn.0045dc1f
add esp, 0x590
ret
Function at 0x45b050
Capabilities:
Hash data with crc32

Disassembly:
test ecx, ecx
jne 0x45b057
xor eax, eax
ret
mov eax, dword [esp + 4]
jmp fcn.0045b060
Function at 0x45dbb0
Capabilities:
Create thread
Resume thread

Disassembly:
push ecx
xor eax, eax
cmp dword [ecx + 0x28], eax
jne 0x45dbc8
cmp dword [ecx + 0x2c], eax
jne 0x45dbc8
mov dword [ecx + 0x34], eax
add esp, 4
jmp fcn.0045dac0
mov byte [esp + 3], al
push 0x485764
lea eax, [esp + 7]
push eax
call fcn.00461916
int3

Function at 0x45dc1f
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x48a348]
jne 0x45dc29
repz ret
jmp fcn.00461b13

Function at 0x46a9ad
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00461c8b
and dword [ebp - 4], 0
cmp dword [0x48d818], 0
mov ebx, eax
jne 0x46aa5e
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x46ab0f
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x476064
push edi
call esi
test eax, eax
je 0x46ab0f
push eax
call fcn.00461c19
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x48d818], eax
call esi
push eax
call fcn.00461c19
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x48d81c], eax
call esi
push eax
call fcn.00461c19
mov dword [esp], 0x476024
push edi
mov dword [0x48d820], eax
call esi
push eax
call fcn.00461c19
pop ecx
mov dword [0x48d828], eax
test eax, eax
je 0x46aa5e
push 0x47600c
push edi
call esi
push eax
call fcn.00461c19
pop ecx
mov dword [0x48d824], eax
mov eax, dword [0x48d824]
cmp eax, ebx
je 0x46aab6
cmp dword [0x48d828], ebx
je 0x46aab6
push eax
call fcn.00461c94
push dword [0x48d828]
mov esi, eax
call fcn.00461c94
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x46aab6
test edi, edi
je 0x46aab6
call esi
test eax, eax
je 0x46aaad
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x46aaad
test byte [ebp - 0xc], 1
jne 0x46aab6
or dword [ebp + 0x10], 0x200000
jmp 0x46aaef
mov eax, dword [0x48d81c]
cmp eax, ebx
je 0x46aaef
push eax
call fcn.00461c94
pop ecx
test eax, eax
je 0x46aaef
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x46aaef
mov eax, dword [0x48d820]
cmp eax, ebx
je 0x46aaef
push eax
call fcn.00461c94
pop ecx
test eax, eax
je 0x46aaef
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x48d818]
call fcn.00461c94
pop ecx
test eax, eax
je 0x46ab0f
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x46ab11
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x410c00
Capabilities:
Packed with generic packer

Disassembly:
int3
cmpsb byte [esi], byte es:[edi]
push ebx
push edi
push esi
and ecx, 0x2c
mov dh, byte [edx + ebp*8 + 0x58]
mov edi, dword [esp + 0x4c]
mov ecx, dword [esp + 0x40]
mov eax, dword [0x50d934]
xor eax, esp
mov dword [ebx + 0x28], eax
mov eax, dword [ecx + 0x144]
test dword [esp + esi*2 - 0x5469ff7], esp
jmp 0x410c2d
add byte [ebx], bh
je 0x410c3a
xor edx, edx
cmp edi, 6
add al, 0x1a
jmp 0x410c63
mov ecx, 0x10f4
sbb ebp, dword [0xf3e7c294]
xor bl, 1
mov al, byte [0xe6da89d3]
popfd
and byte [ecx], dl
test dl, dl
je 0x41c322
cmp eax, 3
mov cl, 0x8c
mov edi, 0x1e009455
push ds
je 0x410c8a
push esp
xchg esp, eax
jno 0x410bf3
push esp
and al, 4
jns 0x410cec
or dword [ebx - 0x3f6af0fc], 0x31
test byte [eax], 0xd0
jne 0x410cec
adc byte [ecx + 4], dh
call 0xd0a9e0
mov ecx, dword [esp + ecx + 0x44]
add esp, 4
xor byte [ebp + 0x10e1], 0
je 0x410ca8
cmp dword [ecx + 0x184], 0
je 0x410cab
cmp dword [ecx + 0xc], 0
je 0x410ca8
add eax, dword [ecx + 0x3c005688]
neg eax
mov edx, dword [ecx + 0x10]
add edx, 0xffffffff
cmp dword [edx], ecx
push ecx
adc byte [ebx + 0xa39ffc2], al
loop 0x410d00
rcr byte [eax + edx*8], 1
sar eax, 0x1b
and ecx, ebx
or dword [ecx + 0x10], eax
mov byte [ecx + 0x20cf], 1
sbb eax, 0x10844a
add byte [eax], al
jne 0x410ce8
push ecx
xor dword [edx + 0x1000010], 0x64a0d516
inc ecx
cmp eax, 0x1994fe8
lea ecx, [ebx - 0x7cb7dbb4]
les ecx, [eax]
mov edx, dword [esp + 4]
mov edi, dword [esp + 0x50]
mov ebx, dword [ecx + 0x128]
mov ch, 0xde
jl 0x410cec
add ebx, 0xffffffff
sbb dword [edx], 0x24
dec esp
add al, 0xf
xchg ebp, eax
mov eax, 0x3474d0b2
mov esi, ebx
test edi, edi
andnps xmm4, xmmword [ebp - 0x7afc1900]
test byte [edi], 0x9e
push edx
add bh, bh
or al, dl
pcmpgtd mm2, qword [esi + 0x4ab80000]
mov ecx, 0xe2c
pop ds
je 0x410db8
mov edi, dword [ecx + 0x4148872c]
add edi, 0xffffffff
and edx, 0xffffffff
jmp 0x410d44
add byte [ebp + 0x4c], dl
and al, 0x44
sub al, 0x33
add al, 0x80
mov ecx, 0xe61044
add byte [esi - 0x7d], dh
mov ecx, 0x184
add byte [ecx], bh
or al, 0x56
jns 0x410d6d
add byte [esi + eax + 0x6f], dh
or dword [eax - 0x8ffffff], 0x10518bd8
invalid
push ecx
invalid
invalid
Function at 0x43c2a0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebx
dec ecx
push esi
sub esp, 0x51
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
mov edx, esp
xor al, 0x20
push eax
add byte [ecx], dh
out 0x89, al
je 0x43c2e1
test bh, al
add al, 0x24
add al, 0x5e
add byte [eax], al
insb byte es:[edi], dx
out 0x8d, al
jl 0x43c2ee
and dword [esi - 4], edx
push edi
push 0
push ecx
xchg ebp, eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
pop esp
or al, 0x24
fucomp st(7)
add dword [ecx], ecx
add byte [esi + 0x331eb3d7], 0x9d
add al, 9
enter 0xffffffffffff940f, 0xffffffffffffffc3
mov ecx, dword [esp + 8]
xlatb
mov bl, 0x1e
xor ebx, dword [ebp + 0xfc80904]
xchg esp, eax
ret
and al, 8
arpl cx, sp
jmp 0x4a1940
mov eax, ecx
imul ebp, dword [eax], 0xd06
mov eax, dword [esi - 0x1d]
cmp eax, dword [edx - 0x1d]
imul edi, dword [ebx + 0xf], 0xb60fc8b6
and ebx, 0xe74c82b
pop ss
rol byte [ebp - 0x3f3af037], 0x8d
push esi
inc ebp
xchg ebp, eax
push eax
inc dword [ebp + 0xfd375c9]
mov dh, 0x4e
in al, 0x1d
pushfd
inc edx
popal
sub ecx, eax
je 0x4a16cd
xor eax, eax
add eax, 0x414e0f84
lea ecx, [eax*2 - 0x780001]
test dword [ebx + 0x75], ecx
mov ch, 0xf
mov dh, 0x4e
in eax, 0xf
mov dh, 0x42
in eax, 0x2b
enter 0xe74, 0x33
rol byte [ebp - 0x786ef037], 0x56
or al, 0x45
push esp
invalid
mov dh, 0x42
imul byte [ebx]
jecxz 0x4a19ba
push cs
stc
sal byte [edi - 0x3f60f037], 0x8d
or al, 0x45
call [ebp - 1]
inc dword [ebp + 0x29850fc9]
std
jmp [edi]
rol byte [ebp - 0x3b60f037], 0x8d
or al, 0xec
dec ebp
inc dword [esi]
test esi, ebp
jne 0x46494186
movzx edx, ch
cli
movzx eax, byte [edx - 6]
sub ecx, eax
je 0x4a19e9
xor eax, eax
add ecx, ecx
psubusw mm0, mm0
lea ecx, [eax*2 - 1]
test ecx, ecx
jne 0x4a1686
mov ebp, ecx
sti
cmp eax, dword [eax - 5]
je 0x4a1a85
paddq mm0, qword [edx - 5]
pslld mm1, qword [esi - 5]
sub edx, dword [ebx + 0x7c330e9b]
test dword [ebp - 0x72bb60f1], ebx
or al, 0x45
jmp [edx - 0x367a0001]
jnp 0xb65a19cd
cmp edi, edi
sub ecx, eax
xor al, byte [ecx + esi*8 + 0x3374fffb]
rol byte [ebp - 0x3fdff037], 0x8d
xor eax, dword [ebp - 1]
invalid

Function at 0x44a680
Capabilities:
Encode data using xor

Disassembly:
add byte fs:[eax], al
add byte [ebx - 0x8a8473c], al
fisub dword [eax + ebp]
call fcn.004372f3
add esp, 4
pop edi
into
mov eax, dword [eax]
je 0x44a669
mov eax, dword [ebx + 8]
mov eax, dword [eax - 7]
ror byte [eax - 0x67], 1
push dword [esi + 0x14]
push eax
call dword [ecx + 0x26]
add esp, 8
aaa
inc esi
add byte [eax], al
rol dword [eax], cl
add bh, bh
jbe 0x44a66b
call fcn.00439860
add esp, 4
mov dword [esi - 0x6f], 0xffff7cff
mov dword [esi + 0x20], 0
mov byte [esi + 0x24], 0
dec esp
and al, 0xb0
ljmp 0x1d
push ebp
push ebx
push edi
push esi
sub esp, 0x28
mov eax, dword [0x502034]
stosd dword es:[edi], eax
loopne 0x44a618
inc esp
and al, 0x24
cmp dword [ecx + 4], 0
pop ebp
test byte [edx + 1], ah
add byte [eax], al
mov ebx, edx
pop ebp
or al, 0x24
mov ebx, eax
and al, 0x40
mov eax, dword [esp + 0x3c]
and dword [edx + 0x5e], 0xf
test ecx, edx
add byte [eax], al
add byte [ecx - 0x76ef20bc], dh
insb byte es:[edi], dx
and al, 0x18
mov dword [esp - 0x22], 0x1c00
invalid
Function at 0x49cf20
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov byte [ecx - 0x53], bh
dec ebp
add byte [ebx + 0x3542427], cl
test ah, cl
mov byte [eax], al
add byte [eax], al
mov esi, dword [esp - 0x35]
adc esi, dword [esp + ecx*8 + 0x7b1008c]
add dword [ecx + 0x54244489], edx
adc esi, edi
mov dword [esp + 0x60], esi
xor dword [esi - 0x75], eax
je 0x49cf70
or byte [esi - 0x3a], bh
mov ecx, esi
dec eax
movsb byte es:[edi], byte [esi]
rcr dword [ecx + ecx*4 + 0x4c], 1
and al, 0x58
invalid
jl 0x49cf96
bound ecx, qword [ecx - 0x7420db84]
inc esp
and al, 0x94
xor eax, edi
ja 0x49cf4a
or eax, ecx
cmp esp, dword [ecx + ebx*8 + 0x248c8901]
add byte [eax], 0
add byte [esp - 0x3d], dh
add dword [ecx - 0x74bbdba4], ecx
push esp
and al, 0x74
mov edi, dword [esp + 0x34]
add edx, edi
mov esi, dword [esp + 0x50]
mov ebx, dword [esp + 0x4c]
insd dword es:[edi], dx
fimul word [ebx - 0x49f0dbfc]
cmp byte [edx - 0x53], 0x4d
add byte [ebx], al
xchg esp, eax
les ecx, [eax + 0x13000000]
mov ah, 0xc4
mov word [eax], es
add byte [eax], al
mov edi, ebp
mov cl, 0x50
mov ecx, dword [esp + 0xc]
xor edi, edi
sahf
dec esp
and al, 0xc
mov esi, dword [ebp + esi - 0x11]
xor dword [ecx], ebx
mov eax, dword [esp + 0x18]
add eax, ecx
mov dword [edi + eax*2 + 5], eax
mov ebp, dword [ecx - 0xeeeebdc]
mov dword [esi - 0x2eceebdc], esp
mov dword [0xfb894c31], esi
jae 0x49cf96
sub byte [edi + 0xf], bl
clc
push es
or byte [edx], ch
invalid

Function at 0x4a0694
Capabilities:
Check for software breakpoints

Disassembly:
mov cl, 0xdf
add byte [eax], ch
popfd
jae 0x4a06b4
push edi
mov edi, dword [esi]
test edi, edi
je 0x4a06ac
dec ecx
iretd
add esi, 4
cmp esi, ebx
jb 0x4a069c
test eax, 0x53ff5b5e
cmp al, 0xcc
adc byte [esi], 0x5b
add byte [ebx + 0x501680], bh
cmp esi, ebx
jae 0x4a06e0
pop esi
pop ebx
call dword [ebx + 0x3c]
int3
push edi
mov edi, dword [esi]
xor eax, 0x8b0a74ff
in al, dx
call dword [fcn.00467000]
call edi
lds ebp, [esi]
or eax, 0xe972c43b
in eax, dx
pop esi
mov esi, 0xccccccc3
int3

Function at 0x4c110b
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
push esi
push 0x2ed760
push 0x4dd758
clc
lodsb al, byte [esi]
les ebx, [edi]
add byte [edx], ch
call fcn.004c12dc
mov esi, eax
add esp, 0x10
pop es
pop ebp
je 0x4c113e
and byte [ebp - 0x23], dh
invalid
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.DLL_TlsAlloc]
Function at 0x4c169c
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
push edi
mov edi, dword [ebp + 8]
xor ecx, ecx
test dword [eax + 0x75], esp
and cl, byte [ebx + 0x3907588e]
pop esi
push eax
push ecx
push ecx
push ecx
push ecx
push ecx
mov byte [eax + 0x1c], 1
mov dword [eax + ebx - 0x18], ebp
ror dword [edi + edi*8 - 0x2a], cl
add esp, 8
mov eax, esi
add al, 0xe4
add byte [eax], al
dec eax
push ebx
xchg ebp, eax
dec ebp
or al, 0x76
push ds
mov edx, dword [ebp + 0x10]
mov eax, edx
or byte [edi], 0x68
sar byte [edi + 2], cl
mov esi, dword [ebx + 0xc459d40]
cmp dword [ecx + 0x981226a], ecx
mov ebx, dword [ebp + 0x14]
test ebx, ebx
jne 0x4c1642
inc eax
popfd
inc ebp
or al, 0x39
mov dword [edx + 0x22], ebp
or dword [ecx], 0x85145d8b
invalid
push 0x16
mov eax, dword [ebp + 0x20]
pop esi
push ecx
push ecx
push ecx
push ecx
push ecx
mov dword [eax + 0x18], esi
push ecx
mov byte [eax + 0x2b], 1
call fcn.004b6275
sbb esi, 0x18
adc eax, 0x8b7feb1d
inc ebx
or byte [ebp + 0x45d50177], cl
jae 0x4c15e8
pop es
outsb dx, byte [esi]
test edx, edx
and dl, byte [esi]
mov bl, byte [eax]
test byte [edi], cl
je 0x4c1631
inc eax
xchg esp, eax
add dh, byte [ebx + 0x461e8830]
mov bl, 0x30
mov byte [esi], bl
inc esi
dec edx
test edx, edx
jg 0x4c1628
rcr byte [ebp + 0x14], 1
mov ah, ah
test edx, edx
js 0x4c166c
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebx]
push eax
push dword [ebp - 4]
call 0x4c169c
add esp, 0x14
test al, al
je 0x4c166c
jmp 0x4c1661
dec esi
mov al, byte [esi]
cmp al, 0xb9
adc esi, esi
add eax, 0x927198ac
jno 0x4c1600
xor dword [ebp + 5], esi
inc dword [ebx + 4]
jmp 0x4c1695
xor eax, eax
pop ebx
pop edi
pop esi
leave
ror dword [ebx - 0x1374aa01], cl
mov edi, edi
push ebp
mov ebp, esp
xor dword [ebx + 0x18], 0x11
jne 0x4c16b2
loopne 0x4c16ee
or al, 0xa9
cmp cl, cl
setge byte [ebp + ebx*2 - 0x3d]
call 0xc44b17fb
test eax, eax
jne 0x4c16ea
mov eax, dword [ebp + 0xc]
scasb al, byte es:[edi]
cmp byte [0xc0470b7f], dh
push ebp
jge 0x4c169c
add byte [ebp + 0x5750172], cl
mov al, 0xce
pop ebp
ret
cmp eax, 0x200
jne 0x4c1701
add byte [ebp + 0x10], dh
mov eax, dword [ebp + 0xc]
cmp byte [eax], 0x30
pop es
sbb eax, 0x2d867d83
je 0x4c1716
jmp 0x4c16ce
add al, 0
aam 0x1c
jg 0x4c177c
push cs
mov eax, dword [ebp + 0xc]
cmp byte [eax], 0x30
insb byte es:[edi], dx
push es
cmp dword [ebp + 0x10], 0x2d
xchg ebp, eax
mov eax, 0x115dc050
inc esi
push eax
rcr byte [ebp + 0x11], 0x46
call dword [ebp - 0x75]
in al, dx
sub esp, 0x970
mov eax, dword [0x502034]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [esi + 0x18]
mov dword [ebp - 0x7aa], eax
fstp xword [edx]
sbb al, 0x89
cli
movsb byte es:[edi], byte [esi]
clc
invalid
enter 0x6c85, 0x37
invalid
mov esi, dword [ebp + 0xc]
cli
push 0x20
pop edi
test esi, esi
jg 0x4c175f
inc eax
push es
cmp dword [ebp + 8], 0
jae 0x4c1794
push 0x75
pop eax
jmp 0x4c1796
mov eax, edi
mov ecx, dword [ebp - 0x34304788]
push 0
push 0
pop es
add dword [ebx - 0x75b7b], ecx
dec dword [ecx - 0x7a72f754]
pushal
jne 0x4c17af
invalid
jmp dword [ecx - 0x1c0c118]
Function at 0x4c5d33
Capabilities:
Encode data using xor

Disassembly:
pop ecx
test esi, esi
jne 0x4c5d46
and eax, eax
push eax
call 0x114c1880
pop ecx
pop edi
je 0x4c5d9f
leave
dec eax
push dword [ecx + 0x5060bc]
call 0xff4c6016
pop ecx
mov ecx, edi
stc
xor eax, 0x5060bc
sbb byte [ecx + 2], dl
push ebx
mov eax, dword [ecx]
xor dword [ebp + 0x453b6602], 0x68
jne 0x4c5d5d
sub edx, dword [ecx + edx*8]
stc
push edi
invalid
invalid

Function at 0x417f70
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x14000]
push edi
jmp 0x417f8a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x417f91
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x417f80
mov eax, 1
add ebx, ebx
jne 0x417fa3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x417f98
jne 0x417fb4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x417f98
xor ecx, ecx
sub eax, 3
jb 0x417fc8
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x41803a
mov ebp, eax
add ebx, ebx
jne 0x417fd3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x417fe0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x418004
inc ecx
add ebx, ebx
jne 0x417ff0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x417fe5
jne 0x418001
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x417fe5
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x418024
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x418015
jmp 0x417f86
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x418024
add edi, ecx
jmp 0x417f86
pop esi
mov edi, esi
mov ecx, 0x315
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x418042
cmp byte [edi], 4
jne 0x418042
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x418047
lea edi, [esi + 0x15000]
mov eax, dword [edi]
or eax, eax
je 0x4180bf
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x18000]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x18078]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x418074
mov ecx, edi
jns 0x4180a3
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x1807c]
or eax, eax
je 0x4180b9
mov dword [ebx], eax
add ebx, 4
jmp 0x418091
call dword [esi + 0x1808c]
mov ebp, dword [esi + 0x18080]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1ff]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x4180f3
sub esp, 0xffffff80
jmp section.UPX0
Function at 0x40139f
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
cmp dword [ebp + 0xc], 0
xorps xmm0, xmm0
push ebx
push esi
mov esi, ecx
mov dword [ebp - 8], edx
push edi
movlpd qword [ebp - 0x10], xmm0
mov edx, dword [esi]
mov ebx, dword [esi + 4]
jl 0x401413
jg 0x4013c8
cmp dword [ebp + 8], 0
jbe 0x401413
mov eax, dword [ebp - 0xc]
mov edi, dword [ebp - 0x10]
mov dword [ebp - 4], eax
inc dl
movzx edx, dl
mov ecx, dword [esi + edx*4 + 8]
lea eax, [ebx + ecx]
movzx ebx, al
mov eax, dword [esi + ebx*4 + 8]
mov dword [esi + edx*4 + 8], eax
mov dword [esi + ebx*4 + 8], ecx
add cl, al
movzx eax, cl
mov ecx, dword [ebp - 8]
mov al, byte [esi + eax*4 + 8]
xor byte [edi + ecx], al
add edi, 1
mov eax, dword [ebp - 4]
adc eax, 0
mov dword [ebp - 4], eax
cmp eax, dword [ebp + 0xc]
jl 0x4013d1
jg 0x401413
cmp edi, dword [ebp + 8]
jb 0x4013d1
pop edi
mov dword [esi + 4], ebx
mov dword [esi], edx
pop esi
pop ebx
leave
ret

Function at 0x4014b6
Capabilities:
Check mutex on windows

Disassembly:
push 0x5c
mov eax, 0x484440
call fcn.0045e574
mov esi, ecx
lea ecx, [ebp - 0x2c]
call fcn.0041b087
and dword [ebp - 4], 0
lea ecx, [ebp - 0x48]
push 0x49b640
call fcn.0041b69b
xor ebx, ebx
lea eax, [ebp - 0x44]
inc ebx
lea ecx, [ebp - 0x28]
push eax
mov byte [ebp - 4], bl
call fcn.0041e21c
lea ecx, [ebp - 0x48]
mov byte [ebp - 4], 0
call fcn.0041bb22
lea eax, [esi + 4]
push eax
lea ecx, [ebp - 0x28]
call fcn.004086f5
lea edx, [ebp - 0x54]
lea ecx, [ebp - 0x68]
call fcn.00420a1d
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
push 0
lea eax, [ebp - 0x54]
push eax
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor ecx, ecx
movzx ebx, bl
cmp eax, 5
cmove ebx, ecx
cmp eax, 0xb7
jne 0x401551
xor bl, bl
test esi, esi
je 0x401551
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x2c]
call fcn.0041bb22
mov al, bl
call fcn.0045e51e
ret
Function at 0x4029c2
Capabilities:
Extract resource via kernel32 functions
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x4b1070]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, ecx
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0x24], ecx
push edi
test esi, esi
jne 0x4029eb
push 0xffffffffffffff88
jmp 0x402a87
push eax
movzx eax, dx
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
test edi, edi
jne 0x402a05
or eax, 0xffffffff
jmp 0x402a88
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x402a15
push 0xfffffffffffffffe
jmp 0x402a87
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
test ebx, ebx
jne 0x402a26
push 0xfffffffffffffffd
jmp 0x402a87
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
test edi, edi
jle 0x402a85
push ecx
mov ecx, dword [ebp - 0x24]
lea eax, [ebp - 0x20]
push eax
call fcn.0041bac9
cmp dword [eax + 0x14], 0x10
jb 0x402a49
mov eax, dword [eax]
push 0x49b6fc
push eax
call fcn.004657a0
pop ecx
pop ecx
lea ecx, [ebp - 0x20]
mov esi, eax
call fcn.004019a2
test esi, esi
jne 0x402a68
push 0xfffffffffffffffc
jmp 0x402a87
push esi
push 1
push edi
push ebx
call fcn.00465ccc
push esi
call fcn.00465945
push esi
call fcn.00465a14
add esp, 0x18
xor eax, eax
jmp 0x402a88
push 0xfffffffffffffffa
pop eax
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0045d929
leave
ret

Function at 0x403747
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, ecx
push edi
test esi, esi
je 0x40378b
mov edi, dword [ebp + 0xc]
test edi, edi
jl 0x40378b
mov ebx, dword [ebp + 8]
jg 0x403763
test ebx, ebx
je 0x40378b
or edx, 0xffffffff
movzx eax, byte [esi]
add ebx, 0xffffffff
movzx ecx, dl
adc edi, 0xffffffff
xor ecx, eax
shr edx, 8
xor edx, dword [ecx*4 + 0x49b760]
mov ecx, ebx
inc esi
or ecx, edi
jne 0x403766
not edx
mov eax, edx
jmp 0x40378d
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x403792
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov edx, ecx
test esi, esi
je 0x4037e6
push edi
mov edi, dword [ebp + 0x10]
test edi, edi
jl 0x4037e5
mov eax, dword [ebp + 0xc]
jg 0x4037b0
test eax, eax
je 0x4037e5
push ebx
mov ebx, dword [edx + 8]
add eax, 0xffffffff
movzx ecx, bl
mov dword [ebp + 8], eax
movzx eax, byte [esi]
adc edi, 0xffffffff
xor ecx, eax
shr ebx, 8
mov eax, dword [ebp + 8]
xor ebx, dword [ecx*4 + 0x49b760]
inc esi
or eax, edi
mov dword [edx + 8], ebx
mov eax, dword [ebp + 8]
jne 0x4037b4
add dword [edx], 0xffffffff
pop ebx
adc dword [edx + 4], 0xffffffff
pop edi
pop esi
pop ebp
ret 0xc