joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46746e
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, dword [esi + 8]
test bl, 3
jne 0x46749f
mov eax, dword fs:[4]
mov dword [ebp + 8], eax
mov eax, dword fs:[8]
mov dword [ebp - 4], eax
cmp ebx, dword [ebp - 4]
jb 0x4674a6
cmp ebx, dword [ebp + 8]
jae 0x4674a6
xor eax, eax
jmp 0x467696
push edi
mov edi, dword [esi + 0xc]
cmp edi, 0xffffffff
jne 0x4674b7
xor eax, eax
inc eax
jmp 0x467695
xor edx, edx
mov dword [ebp + 8], edx
mov eax, ebx
mov ecx, dword [eax]
cmp ecx, 0xffffffff
je 0x4674cd
cmp ecx, edx
jae 0x467612
cmp dword [eax + 4], 0
je 0x4674d6
inc dword [ebp + 8]
inc edx
add eax, 0xc
cmp edx, edi
jbe 0x4674be
cmp dword [ebp + 8], 0
je 0x4674f8
mov eax, dword [esi - 8]
cmp eax, dword [ebp - 4]
jb 0x467612
cmp eax, esi
jae 0x467612
mov eax, dword [0x4ab9c8]
mov edi, ebx
and edi, 0xfffff000
xor esi, esi
test eax, eax
jle 0x46751d
cmp dword [esi*4 + 0x4ab9d0], edi
je 0x467616
inc esi
cmp esi, eax
jl 0x46750b
push 0x1c
lea eax, [ebp - 0x20]
push eax
push ebx
call dword [0x4721b4]
test eax, eax
je 0x467692
cmp dword [ebp - 8], 0x1000000
jne 0x467692
test byte [ebp - 0xc], 0xcc
je 0x46759b
mov ecx, dword [ebp - 0x1c]
cmp word [ecx], 0x5a4d
jne 0x467692
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x467692
cmp word [eax + 0x18], 0x10b
jne 0x467692
sub ebx, ecx
cmp word [eax + 6], 0
movzx ecx, word [eax + 0x14]
lea ecx, [ecx + eax + 0x18]
jbe 0x467692
mov eax, dword [ecx + 0xc]
cmp ebx, eax
jb 0x46759b
mov edx, dword [ecx + 8]
add edx, eax
cmp ebx, edx
jae 0x46759b
test byte [ecx + 0x27], 0x80
jne 0x467612
push 1
push 0x4aba10
call dword [0x4721c4]
test eax, eax
jne 0x4674af
mov ecx, dword [0x4ab9c8]
test ecx, ecx
mov edx, ecx
jle 0x4675cf
lea eax, [ecx*4 + 0x4ab9cc]
cmp dword [eax], edi
je 0x4675cf
dec edx
sub eax, 4
test edx, edx
jg 0x4675c3
test edx, edx
jne 0x467600
push 0xf
pop ebx
cmp ecx, ebx
jg 0x4675dc
mov ebx, ecx
xor edx, edx
test ebx, ebx
jl 0x4675f4
lea eax, [edx*4 + 0x4ab9d0]
mov esi, dword [eax]
inc edx
cmp edx, ebx
mov dword [eax], edi
mov edi, esi
jle 0x4675e2
cmp ecx, 0x10
jge 0x467600
inc ecx
mov dword [0x4ab9c8], ecx
push 0
push 0x4aba10
call dword [0x4721c4]
jmp 0x4674af
xor eax, eax
jmp 0x467695
test esi, esi
jle 0x4674af
mov ebx, dword [0x4721c4]
push 1
push 0x4aba10
call ebx
test eax, eax
jne 0x4674af
cmp dword [esi*4 + 0x4ab9d0], edi
je 0x46766c
mov eax, dword [0x4ab9c8]
lea esi, [eax - 1]
test esi, esi
jl 0x46765a
cmp dword [esi*4 + 0x4ab9d0], edi
je 0x467656
dec esi
jns 0x46764a
test esi, esi
jge 0x46766a
cmp eax, 0x10
jge 0x467665
inc eax
mov dword [0x4ab9c8], eax
lea esi, [eax - 1]
jmp 0x46766c
je 0x467684
xor ecx, ecx
test esi, esi
jl 0x467684
lea eax, [ecx*4 + 0x4ab9d0]
mov edx, dword [eax]
inc ecx
cmp ecx, esi
mov dword [eax], edi
mov edi, edx
jle 0x467672
push 0
push 0x4aba10
call ebx
jmp 0x4674af
or eax, 0xffffffff
pop edi
pop esi
pop ebx
leave
ret
Function at 0xdb30b0
Capabilities:
Decompress data using aplib

Disassembly:
call 0xdb3200
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0xdb30d6
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xdb30c2
add dl, dl
jne 0xdb30e1
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xdb3134
xor eax, eax
add dl, dl
jne 0xdb30ee
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xdb31d5
add dl, dl
jne 0xdb30fd
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xdb3108
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xdb3113
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xdb311e
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0xdb312a
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0xdb30cd
mov eax, 1
add dl, dl
jne 0xdb3142
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xdb314d
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xdb3139
sub eax, ebx
mov ebx, 1
jne 0xdb3180
mov ecx, 1
add dl, dl
jne 0xdb3166
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xdb3171
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xdb315d
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xdb30cd
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0xdb3197
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xdb31a2
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xdb318e
cmp eax, 0x7d00
jae 0xdb31c5
cmp eax, 0x500
jb 0xdb31c0
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xdb30cd
cmp eax, 0x7f
ja 0xdb31c8
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xdb30cd
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0xdb31f6
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0xdb30cd
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x4047f0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x436c28
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, dword [esp + 0x1c]
mov eax, dword [esi]
mov ecx, dword [eax - 0x10]
mov edx, dword [ecx]
push edi
xor edi, edi
mov dword [esp + 8], edi
call dword [edx + 0x10]
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x24]
mov eax, dword [eax]
mov edx, dword [eax - 0xc]
mov ecx, dword [esi]
mov esi, dword [ecx - 0xc]
push edx
push eax
push esi
push ecx
lea ecx, [esp + 0x30]
push ecx
mov dword [esp + 0x28], edi
call fcn.00403c70
mov esi, dword [esp + 0x34]
add esi, 0xfffffff0
push esi
call fcn.004012c0
mov edi, dword [esp + 0x34]
add eax, 0x10
mov dword [edi], eax
add esp, 0x18
mov dword [esp + 0x14], 0xffffffff
lea edx, [esi + 0xc]
or eax, 0xffffffff
lock xadd dword [edx], eax
dec eax
test eax, eax
jg 0x404882
mov ecx, dword [esi]
mov edx, dword [ecx]
push esi
call dword [edx + 4]
mov ecx, dword [esp + 0xc]
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x40b0c0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x437103
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0x10], esi
call fcn.00430520
xor ecx, ecx
lea ebp, [esi + 0x10]
mov dword [esi], 0x43b1e8
mov dword [esp + 0x24], ecx
mov dword [ebp + 4], ecx
mov dword [ebp], 0x43e028
mov ebx, dword [esp + 0x2c]
xor eax, eax
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x18], ecx
cmp dword [ebx + 0xc], ecx
sete al
mov byte [esp + 0x24], 1
lea edi, [esi + 0x20]
mov dword [esi + 0x30], eax
mov eax, dword [esp + 0x30]
cmp eax, ecx
jne 0x40b12f
mov edx, dword [ebx]
push edi
mov ecx, ebx
call dword [edx + 0x50]
jmp 0x40b147
mov edx, dword [eax]
mov ecx, edi
mov dword [ecx], edx
mov edx, dword [eax + 4]
mov dword [ecx + 4], edx
mov edx, dword [eax + 8]
mov dword [ecx + 8], edx
mov eax, dword [eax + 0xc]
mov dword [ecx + 0xc], eax
mov eax, dword [esi + 0x30]
test eax, eax
je 0x40b1be
mov eax, dword [ebx + 4]
push eax
call dword [0x439140]
push eax
mov ecx, esi
call fcn.0043098c
mov ecx, dword [edi + 4]
mov eax, dword [edi + 0xc]
mov edx, dword [edi]
sub eax, ecx
mov ecx, dword [edi + 8]
sub ecx, edx
push eax
push ecx
mov ecx, dword [ebx + 4]
push ecx
call dword [0x439130]
push eax
mov ecx, ebp
call fcn.00430c89
test ebp, ebp
je 0x40b18a
mov ebp, dword [ebp + 4]
mov edx, dword [esi + 4]
push ebp
push edx
call fcn.00430d12
mov dword [esi + 0x18], eax
mov eax, dword [ebx + 8]
push eax
call dword [0x439104]
push eax
mov ecx, esi
call fcn.00430479
mov ecx, dword [esi + 0x24]
mov edx, dword [edi]
push ecx
push edx
lea eax, [esp + 0x1c]
push eax
mov ecx, esi
call fcn.00430670
jmp 0x40b1d0
mov ecx, dword [ebx + 0xc]
mov dword [esi + 0xc], ecx
mov edx, dword [ebx + 4]
mov dword [esi + 4], edx
mov eax, dword [ebx + 8]
mov dword [esi + 8], eax
push 0xffffff
push edi
mov ecx, esi
call fcn.004323f1
mov ecx, dword [esp + 0x1c]
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18
ret 8
Function at 0x40b980
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4371a0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x4c
mov eax, dword [0x44932c]
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0x58], eax
mov dword [esp + 0x18], esi
call fcn.0042a0bb
xor ebp, ebp
mov dword [esi], 0x43b280
mov eax, 0xa
mov dword [esp + 0x64], ebp
mov dword [esi + 0x50], 0x43b260
mov dword [esi + 0x5c], ebp
mov dword [esi + 0x60], ebp
mov dword [esi + 0x58], ebp
mov dword [esi + 0x54], ebp
mov dword [esi + 0x64], ebp
mov dword [esi + 0x68], eax
mov dword [esi + 0x6c], 0x43b26c
mov dword [esi + 0x70], ebp
mov dword [esi + 0x74], 0x11
mov dword [esi + 0x78], ebp
mov dword [esi + 0x7c], ebp
mov dword [esi + 0x80], ebp
mov dword [esi + 0x84], eax
lea ebx, [esi + 0x9c]
mov dword [ebx + 4], ebp
mov dword [ebx], 0x43e06c
lea edi, [esi + 0xa4]
mov dword [edi + 4], ebp
mov dword [edi], 0x43e038
lea ecx, [esi + 0xbc]
mov byte [esp + 0x64], 4
call fcn.004285a6
push 0xc8c8c8
push 1
push ebp
mov byte [esp + 0x70], 5
mov dword [esi + 0x88], ebp
mov dword [esi + 0x90], ebp
mov dword [esi + 0x98], ebp
mov dword [esi + 0x94], ebp
mov dword [esi + 0xb0], 0xffffffff
call dword [0x439108]
push eax
mov ecx, edi
call fcn.00430c89
mov dl, byte [0x43b27e]
xor eax, eax
mov ecx, 0xe
lea edi, [esp + 0x20]
rep stosd dword es:[edi], eax
mov eax, dword [0x43b278]
mov cx, word [0x43b27c]
mov dword [esp + 0x38], eax
lea eax, [esp + 0x1c]
push eax
mov dword [esp + 0x20], 0xfffffff5
mov dword [esp + 0x30], 0x190
mov word [esp + 0x40], cx
mov byte [esp + 0x42], dl
call dword [0x439120]
push eax
mov ecx, ebx
call fcn.00430c89
push 4
push 4
push 0x19
push 0x10
mov dword [esi + 0xac], 0xfeca7f
mov dword [esi + 0xb8], ebp
mov dword [esi + 0xb4], ebp
push 0x10
lea ecx, [esi + 0xbc]
call fcn.0042871e
mov dword [esp + 0x14], ebp
mov dword [esp + 0x10], 0x43e028
mov byte [esp + 0x64], 6
call fcn.00433ddc
movzx ecx, word [esp + 0x6c]
mov eax, dword [eax + 0xc]
push ecx
push eax
call dword [0x4394c4]
push eax
lea ecx, [esp + 0x14]
call fcn.00430c89
mov edx, dword [esp + 0x14]
mov eax, dword [esi + 0xc0]
push 0xff00ff
push edx
push eax
call dword [0x43903c]
lea ecx, [esp + 0x10]
mov dword [esi + 0xc4], ebp
mov byte [esp + 0x64], 5
mov dword [esp + 0x10], 0x43db9c
call fcn.00430ce0
mov ecx, dword [esp + 0x5c]
pop edi
mov eax, esi
pop esi
pop ebp
mov dword fs:[0], ecx
mov ecx, dword [esp + 0x4c]
pop ebx
call fcn.0041c4e7
add esp, 0x58
ret 4
Function at 0x40e8a0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x437328
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x48
mov eax, dword [ebp + 0xc]
mov edx, dword [eax + 8]
mov ecx, dword [ebp + 0x14]
push ebx
push esi
mov esi, dword [eax]
mov eax, edx
sub eax, esi
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 0x10]
fild dword [esp + 0xc]
movzx ebx, cl
push edi
movzx edi, al
sub ebx, edi
mov dword [esp + 0x18], ebx
mov dword [esp + 0x30], edi
movzx edi, ah
fild dword [esp + 0x18]
movzx ebx, ch
fdiv st(1)
sub ebx, edi
mov dword [esp + 0x20], ebx
shr ecx, 0x10
shr eax, 0x10
movzx eax, al
movzx ecx, cl
sub ecx, eax
cmp esi, edx
mov dword [esp + 0x28], ecx
mov dword [esp + 0x38], edi
mov dword [esp + 0x40], eax
fstp qword [esp + 0x18]
fild dword [esp + 0x20]
fdiv st(1)
fstp qword [esp + 0x20]
fild dword [esp + 0x28]
fdiv st(1)
fstp qword [esp + 0x10]
fstp st(0)
fild dword [esp + 0x30]
fstp qword [esp + 0x30]
fild dword [esp + 0x38]
fstp qword [esp + 0x38]
fild dword [esp + 0x40]
fstp qword [esp + 0x40]
jg 0x40ea18
mov edi, dword [ebp + 8]
fld qword [esp + 0x40]
call fcn.0041d040
fld qword [esp + 0x38]
xor ebx, ebx
mov bh, al
call fcn.0041d040
fld qword [esp + 0x30]
mov bl, al
shl ebx, 8
call fcn.0041d040
movzx edx, al
or ebx, edx
push ebx
push 1
push 0
lea ecx, [esp + 0x34]
call fcn.00430dff
lea eax, [esp + 0x28]
push eax
mov ecx, edi
mov dword [esp + 0x60], 0
call fcn.00430d65
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx + 4]
push edx
mov ebx, eax
push esi
lea eax, [esp + 0x50]
push eax
mov ecx, edi
call fcn.00430760
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx + 0xc]
push edx
push esi
mov ecx, edi
call fcn.004304b7
push ebx
mov ecx, edi
call fcn.00430d65
fld qword [esp + 0x30]
fadd qword [esp + 0x18]
lea ecx, [esp + 0x28]
mov dword [esp + 0x5c], 0xffffffff
mov dword [esp + 0x28], 0x43db9c
fstp qword [esp + 0x30]
fld qword [esp + 0x38]
fadd qword [esp + 0x20]
fstp qword [esp + 0x38]
fld qword [esp + 0x40]
fadd qword [esp + 0x10]
fstp qword [esp + 0x40]
call fcn.00430ce0
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax + 8]
inc esi
cmp esi, ecx
jle 0x40e954
mov ecx, dword [esp + 0x54]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x40ea30
Capabilities:
Access peb ldr_data
Check for peb beingdebugged flag

Disassembly:
push 0xffffffffffffffff
push 0x437348
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
push ebx
push ebp
push esi
push edi
mov edi, ecx
mov ecx, dword [edi + 0x1c]
lea eax, [esp + 0x14]
push eax
push ecx
call dword [0x4395e0]
mov ebx, dword [0x4394dc]
push 2
call ebx
mov edx, dword [esp + 0x18]
mov esi, dword [esp + 0x34]
mov ebp, eax
mov eax, dword [esp + 0x1c]
dec eax
push edx
push eax
mov eax, dword [esi + 4]
push eax
call dword [0x439134]
push eax
push ebp
lea ecx, [esp + 0x1c]
push ecx
push esi
mov ecx, edi
call fcn.0040e8a0
mov ecx, dword [esp + 0x14]
mov ebp, dword [esi]
add ecx, 2
push 9
mov dword [esp + 0x18], ecx
call ebx
push eax
mov ecx, esi
call dword [ebp + 0x30]
push 1
mov ecx, esi
mov ebx, eax
call fcn.0043041c
mov edx, dword [esi]
push 0xd
mov ecx, esi
mov ebp, eax
call dword [edx + 0x24]
mov dword [esp + 0x34], eax
call fcn.0042eb3e
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [esp + 0x10], eax
lea eax, [esp + 0x10]
push eax
mov ecx, edi
mov dword [esp + 0x30], 0
call fcn.0042b714
mov eax, dword [esp + 0x10]
mov ecx, dword [eax - 0xc]
mov edx, dword [esi]
push 0x8024
lea edi, [esp + 0x18]
push edi
push ecx
push eax
mov ecx, esi
call dword [edx + 0x68]
mov eax, dword [esi]
push ebx
mov ecx, esi
call dword [eax + 0x30]
push ebp
mov ecx, esi
call fcn.0043041c
mov eax, dword [esp + 0x34]
mov edx, dword [esi]
push eax
mov ecx, esi
call dword [edx + 0x28]
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
mov dword [esp + 0x2c], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
pop edi
pop esi
pop ebp
pop ebx
jg 0x40eb49
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
add esp, 0x20
ret 4

Function at 0x411340
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x43749b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
mov esi, dword [esp + 0x1c]
mov ebx, ecx
push esi
lea ecx, [ebx + 4]
mov dword [esp + 0xc], ebx
mov dword [ebx], 0x43bd38
call fcn.0040d160
push esi
lea eax, [ebx + 0x1c]
push eax
mov dword [esp + 0x1c], 0
call dword [0x439348]
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x28]
mov dword [ebx + 0x10], eax
mov eax, dword [esp + 0x30]
and eax, 0xffff
push eax
mov dword [ebx + 8], ecx
mov dword [ebx + 0xc], edx
mov dword [ebx + 0x14], eax
call fcn.0042df3d
add esp, 4
test eax, eax
mov dword [ebx + 0x18], eax
je 0x4113d2
mov esi, dword [esp + 0x2c]
test esi, esi
je 0x4113d2
mov ecx, dword [ebx + 0x14]
mov edx, ecx
push edi
shr ecx, 2
mov edi, eax
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
mov ecx, dword [esp + 0xc]
pop esi
mov eax, ebx
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 0x18
Function at 0x41d48e
Capabilities:
Parse pe header
Terminate process

Disassembly:
push 0x60
push 0x43f868
call fcn.0041ddb4
mov edi, 0x94
mov eax, edi
call fcn.0041cf90
mov dword [ebp - 0x18], esp
mov esi, esp
mov dword [esi], edi
push esi
call dword [0x439368]
mov ecx, dword [esi + 0x10]
mov dword [0x44c2e4], ecx
mov eax, dword [esi + 4]
mov dword [0x44c2f0], eax
mov edx, dword [esi + 8]
mov dword [0x44c2f4], edx
mov esi, dword [esi + 0xc]
and esi, 0x7fff
mov dword [0x44c2e8], esi
cmp ecx, 2
je 0x41d4ee
or esi, 0x8000
mov dword [0x44c2e8], esi
shl eax, 8
add eax, edx
mov dword [0x44c2ec], eax
xor esi, esi
push esi
mov edi, dword [0x4392c4]
call edi
cmp word [eax], 0x5a4d
jne 0x41d529
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x41d529
movzx eax, word [ecx + 0x18]
cmp eax, 0x10b
je 0x41d541
cmp eax, 0x20b
je 0x41d52e
mov dword [ebp - 0x1c], esi
jmp 0x41d555
cmp dword [ecx + 0x84], 0xe
jbe 0x41d529
xor eax, eax
cmp dword [ecx + 0xf8], esi
jmp 0x41d54f
cmp dword [ecx + 0x74], 0xe
jbe 0x41d529
xor eax, eax
cmp dword [ecx + 0xe8], esi
setne al
mov dword [ebp - 0x1c], eax
push 1
call fcn.00420b4e
pop ecx
test eax, eax
jne 0x41d569
push 0x1c
call fcn.0041d46a
pop ecx
call fcn.0041f9ca
test eax, eax
jne 0x41d57a
push 0x10
call fcn.0041d46a
pop ecx
call fcn.0042083f
mov dword [ebp - 4], esi
call fcn.004238e0
test eax, eax
jge 0x41d593
push 0x1b
call fcn.0041d445
pop ecx
call dword [0x4391cc]
mov dword [0x44dba0], eax
call fcn.004237be
mov dword [0x44c330], eax
call fcn.0042371c
test eax, eax
jge 0x41d5b9
push 8
call fcn.0041d445
pop ecx
call fcn.004234e9
test eax, eax
jge 0x41d5ca
push 9
call fcn.0041d445
pop ecx
push 1
call fcn.0041c62e
pop ecx
mov dword [ebp - 0x28], eax
cmp eax, esi
je 0x41d5e0
push eax
call fcn.0041d445
pop ecx
mov dword [ebp - 0x44], esi
lea eax, [ebp - 0x70]
push eax
call dword [0x4391d0]
call fcn.0042348c
mov dword [ebp - 0x20], eax
test byte [ebp - 0x44], 1
je 0x41d601
movzx eax, word [ebp - 0x40]
jmp 0x41d604
push 0xa
pop eax
push eax
push dword [ebp - 0x20]
push esi
push esi
call edi
push eax
call fcn.004282e4
mov edi, eax
mov dword [ebp - 0x2c], edi
cmp dword [ebp - 0x1c], esi
jne 0x41d622
push edi
call fcn.0041c75b
call fcn.0041c77d
jmp 0x41d654
or dword [ebp - 4], 0xffffffff
mov eax, edi
lea esp, [ebp - 0x7c]
call fcn.0041ddef
ret
Function at 0x4216dd
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, dword [esi + 8]
test bl, 3
jne 0x42170b
mov eax, dword fs:[0x18]
mov dword [ebp + 8], eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 8]
cmp ebx, ecx
mov dword [ebp - 4], ecx
jb 0x421712
cmp ebx, dword [eax + 4]
jae 0x421712
xor eax, eax
jmp 0x421902
push edi
mov edi, dword [esi + 0xc]
cmp edi, 0xffffffff
jne 0x421723
xor eax, eax
inc eax
jmp 0x421901
xor edx, edx
mov dword [ebp + 8], edx
mov eax, ebx
mov ecx, dword [eax]
cmp ecx, 0xffffffff
je 0x421739
cmp ecx, edx
jae 0x42187e
cmp dword [eax + 4], 0
je 0x421742
inc dword [ebp + 8]
inc edx
add eax, 0xc
cmp edx, edi
jbe 0x42172a
cmp dword [ebp + 8], 0
je 0x421764
mov eax, dword [esi - 8]
cmp eax, dword [ebp - 4]
jb 0x42187e
cmp eax, esi
jae 0x42187e
mov eax, dword [0x44c4b8]
mov edi, ebx
and edi, 0xfffff000
xor esi, esi
test eax, eax
jle 0x421789
cmp dword [esi*4 + 0x44c4c0], edi
je 0x421882
inc esi
cmp esi, eax
jl 0x421777
push 0x1c
lea eax, [ebp - 0x20]
push eax
push ebx
call dword [0x4391d4]
test eax, eax
je 0x4218fe
cmp dword [ebp - 8], 0x1000000
jne 0x4218fe
test byte [ebp - 0xc], 0xcc
je 0x421807
mov ecx, dword [ebp - 0x1c]
cmp word [ecx], 0x5a4d
jne 0x4218fe
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x4218fe
cmp word [eax + 0x18], 0x10b
jne 0x4218fe
sub ebx, ecx
cmp word [eax + 6], 0
movzx ecx, word [eax + 0x14]
lea ecx, [ecx + eax + 0x18]
jbe 0x4218fe
mov eax, dword [ecx + 0xc]
cmp ebx, eax
jb 0x421807
mov edx, dword [ecx + 8]
add edx, eax
cmp ebx, edx
jae 0x421807
test byte [ecx + 0x27], 0x80
jne 0x42187e
push 1
push 0x44c500
call dword [0x439350]
test eax, eax
jne 0x42171b
mov ecx, dword [0x44c4b8]
test ecx, ecx
mov edx, ecx
jle 0x42183b
lea eax, [ecx*4 + 0x44c4bc]
cmp dword [eax], edi
je 0x42183b
dec edx
sub eax, 4
test edx, edx
jg 0x42182f
test edx, edx
jne 0x42186c
push 0xf
pop ebx
cmp ecx, ebx
jg 0x421848
mov ebx, ecx
xor edx, edx
test ebx, ebx
jl 0x421860
lea eax, [edx*4 + 0x44c4c0]
mov esi, dword [eax]
inc edx
cmp edx, ebx
mov dword [eax], edi
mov edi, esi
jle 0x42184e
cmp ecx, 0x10
jge 0x42186c
inc ecx
mov dword [0x44c4b8], ecx
push 0
push 0x44c500
call dword [0x439350]
jmp 0x42171b
xor eax, eax
jmp 0x421901
test esi, esi
jle 0x42171b
mov ebx, dword [0x439350]
push 1
push 0x44c500
call ebx
test eax, eax
jne 0x42171b
cmp dword [esi*4 + 0x44c4c0], edi
je 0x4218d8
mov eax, dword [0x44c4b8]
lea esi, [eax - 1]
test esi, esi
jl 0x4218c6
cmp dword [esi*4 + 0x44c4c0], edi
je 0x4218c2
dec esi
jns 0x4218b6
test esi, esi
jge 0x4218d6
cmp eax, 0x10
jge 0x4218d1
inc eax
mov dword [0x44c4b8], eax
lea esi, [eax - 1]
jmp 0x4218d8
je 0x4218f0
xor ecx, ecx
test esi, esi
jl 0x4218f0
lea eax, [ecx*4 + 0x44c4c0]
mov edx, dword [eax]
inc ecx
cmp ecx, esi
mov dword [eax], edi
mov edi, edx
jle 0x4218de
push 0
push 0x44c500
call ebx
jmp 0x42171b
or eax, 0xffffffff
pop edi
pop esi
pop ebx
leave
ret
Function at 0x518db0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0xb4000]
push edi
or ebp, 0xffffffff
jmp 0x518dd2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x518dd9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x518dc8
mov eax, 1
add ebx, ebx
jne 0x518deb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x518dfc
jne 0x518e1b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x518e1b
dec eax
add ebx, ebx
jne 0x518e08
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x518de0
add ebx, ebx
jne 0x518e17
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x518e6d
xor ecx, ecx
sub eax, 3
jb 0x518e33
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x518ea2
sar eax, 1
mov ebp, eax
jmp 0x518e3e
add ebx, ebx
jne 0x518e3e
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x518e0c
inc ecx
add ebx, ebx
jne 0x518e4c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x518e0c
add ebx, ebx
jne 0x518e59
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x518e4e
jne 0x518e6a
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x518e4e
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x518e8c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x518e7e
jmp 0x518dce
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x518e8c
add edi, ecx
jmp 0x518dce
pop esi
mov edi, esi
mov ecx, 0x3842
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x518eaa
cmp byte [edi], 0x15
jne 0x518eaa
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x518eaf
lea edi, [esi + 0x115000]
mov eax, dword [edi]
or eax, eax
je 0x518f27
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x12aa54]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x12ab18]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x518edc
mov ecx, edi
jns 0x518f0b
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x12ab20]
or eax, eax
je 0x518f21
mov dword [ebx], eax
add ebx, 4
jmp 0x518ef9
call dword [esi + 0x12ab1c]
mov ebp, dword [esi + 0x12ab24]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x21f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x518f5b
sub esp, 0xffffff80
jmp 0x470a51