joyce8/EMBER2024-capa huggingface dataset:
Function at 0x404610
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x40464f
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x40464f
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x40464f
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x40464f
cmp dword [ecx + 0x74], 0xe
jbe 0x40464f
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x7c5058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.007c51a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x7c507e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x7c506a
add dl, dl
jne 0x7c5089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x7c50dc
xor eax, eax
add dl, dl
jne 0x7c5096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x7c517d
add dl, dl
jne 0x7c50a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x7c50b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x7c50bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x7c50c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x7c50d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x7c5075
mov eax, 1
add dl, dl
jne 0x7c50ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x7c50f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x7c50e1
sub eax, ebx
mov ebx, 1
jne 0x7c5128
mov ecx, 1
add dl, dl
jne 0x7c510e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x7c5119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x7c5105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x7c5075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x7c513f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x7c514a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x7c5136
cmp eax, 0x7d00
jae 0x7c516d
cmp eax, 0x500
jb 0x7c5168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x7c5075
cmp eax, 0x7f
ja 0x7c5170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x7c5075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x7c519e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x7c5075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x432001
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
mov eax, section..rsrc
nop
nop
push 4
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
je 0x432072
nop
nop
nop
mov ebx, 0x40c7d0
nop
nop
nop
nop
nop
mov ecx, ebx
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
nop
div edi
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
nop
mov esi, 0x306f22c1
nop
nop
xor dword [eax], esi
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
nop
nop
loop 0x432060
nop
mov eax, section..data
cmp eax, 0
nop
nop
nop
nop
je 0x4320d2
nop
nop
nop
nop
mov ebx, 0x42f314
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
push eax
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
pop eax
nop
nop
mov esi, 0x2c4d6953
nop
nop
nop
nop
nop
xor dword [eax], esi
nop
add eax, edi
nop
nop
nop
nop
loop 0x4320c0
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x431219

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x10004830
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov eax, dword [ecx]
mov edx, eax
xor edx, esi
lock cmpxchg dword [ecx], edx
jne 0x10004839
xor eax, esi
pop esi
pop ebp
ret 4

Function at 0x10004850
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov eax, dword [ecx]
mov edx, eax
xor edx, esi
lock cmpxchg dword [ecx], edx
jne 0x10004859
xor eax, esi
pop esi
pop ebp
ret 4

Function at 0x100055a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov eax, dword [ecx]
mov edx, eax
xor edx, esi
lock cmpxchg dword [ecx], edx
jne 0x100055a9
pop esi
pop ebp
ret 8

Function at 0x100055c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov eax, dword [ecx]
mov edx, eax
xor edx, esi
lock cmpxchg dword [ecx], edx
jne 0x100055c9
pop esi
pop ebp
ret 4

Function at 0x100055e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov eax, dword [ecx]
mov edx, eax
xor edx, esi
lock cmpxchg dword [ecx], edx
jne 0x100055e9
pop esi
pop ebp
ret 8

Function at 0x100186b0
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
mov eax, dword [0x1018092c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x101837c8]
push ebx
xor ebx, ebx
mov dword [ebp - 0x60], ebx
test eax, eax
jne 0x10018788
push esi
push 0x55
pop esi
push esi
push 0x101837d0
push 0x5c
push ebx
call dword [sym.imp.kernel32.dll_GetLocaleInfoEx]
test eax, eax
jle 0x10018772
push esi
lea eax, [ebp - 0x5c]
push ebx
push eax
call fcn.100a9420
add esp, 0xc
mov eax, ebx
cmp word [eax*2 + 0x101837d0], 0x5f
mov cl, 0x2d
je 0x10018712
mov cl, byte [eax*2 + 0x101837d0]
mov byte [ebp + eax - 0x5c], cl
test cl, cl
je 0x1001871f
inc eax
cmp eax, esi
jl 0x100186fe
cmp eax, esi
push 0x41
sbb al, al
and byte [ebp - 8], al
call fcn.100d6e93
mov esi, eax
pop ecx
test esi, esi
je 0x10018772
lea eax, [ebp - 0x60]
push eax
push 0x40
lea eax, [ebp - 0x5c]
push esi
push eax
call fcn.100d6e93
add esp, 0x10
cmp dword [ebp - 0x60], ebx
jg 0x1001876b
push 0x10017f70
push 0x17
mov byte [eax + esi], bl
mov dword [0x101837c8], esi
mov byte [0x101837cc], 1
call fcn.100d6e93
pop ecx
jmp 0x10018771
push esi
call fcn.100d6e93
pop ecx
mov ecx, dword [0x101837c8]
mov eax, 0x100fef10
test ecx, ecx
pop esi
cmovne eax, ecx
mov dword [0x101837c8], eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.10084499
leave
ret
Function at 0x100d6e93
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
pushal
call 0x100d6ea2
pop dword [ebp - 0x10]
mov eax, 0x7e521b0a
add eax, 0x91bb5398
sub dword [ebp - 0x10], eax
push 0x40
push 0x1000
push 0x73572
push 0
mov eax, 0x94563192
sub eax, 0x8447004e
add eax, dword [ebp - 0x10]
call dword [eax]
mov ecx, 0xfb6eb8ff
sub ecx, 0xfb6e6b59
xor edi, edi
add edi, eax
mov ebx, 0x59e7eee5
add ebx, 0xb631211b
add ebx, dword [ebp - 0x10]
mov edx, 0x624f88b2
add dword [ebp - 0xc], edi
mov esi, dword [ebx]
add dword [ebp - 4], eax
sub esi, edx
sub dword [ebp - 8], esi
mov dword [edi], esi
xor dword [ebp - 4], edx
add edi, 0x1068ce53
add edi, 0xef9731b1
add ebx, 0x88464ceb
sub ebx, 0x88464ce7
loop 0x100d6efd
add eax, 0xab741e65
add eax, 0x548d0b06
mov ebx, eax
add eax, 5
mov ecx, 0x4161f3e0
sub ecx, 0x3161f3e0
add ecx, dword [ebp - 0x10]
call ebx
leave
ret

Function at 0x438ca9
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov esi, 0x438a14
and eax, eax
sub edx, 0x44183db7
call fcn.00438cd9
mov eax, edx
and eax, eax
xor dword [ebx], esi
dec eax
inc edx
or eax, eax
add ebx, 1
mov eax, 0xfed1d035
cmp ebx, edi
jne fcn.00438ca9
sub edx, eax
ret
Function at 0x408d51
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
lea ebx, [ebp - 0x244]
sub esp, 0x254
mov dword [esp + 4], 0x104
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push edx
push edx
lea edx, [eax - 1]
cmp edx, 0x103
ja 0x408d8f
xor edx, edx
cmp word [ebp + eax*2 - 0x246], 0x5c
sete dl
jmp 0x408d96
xor eax, eax
mov edx, 1
mov ecx, dword [ebp + 8]
add edx, edx
add eax, eax
add edx, 0x40c6a8
add eax, ebx
mov dword [esp + 4], str._s_S.dll
mov dword [esp + 8], edx
mov dword [esp], eax
mov dword [esp + 0xc], ecx
call dword [sym.imp.USER32.dll_wsprintfW]
mov dword [esp], ebx
mov dword [esp + 8], 8
mov dword [esp + 4], 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
sub esp, 0xc
mov ebx, dword [ebp - 4]
leave
ret 4

Function at 0x408f64
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x43a424], 0
push ebp
mov ebp, esp
push esi
push ebx
mov edx, dword [ebp + 0xc]
jne 0x408fa1
xor ecx, ecx
mov eax, ecx
mov ebx, 8
mov esi, eax
and eax, 1
neg eax
shr esi, 1
and eax, 0xedb88320
xor eax, esi
dec ebx
jne 0x408f7e
mov dword [ecx*4 + 0x43a420], eax
inc ecx
cmp ecx, 0x100
jne 0x408f77
mov eax, dword [ebp + 8]
mov ebx, dword [ebp + 0x10]
not eax
add ebx, edx
cmp edx, ebx
je 0x408fc4
inc edx
mov cl, byte [edx - 1]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x43a420]
jmp 0x408fab
pop ebx
not eax
pop esi
pop ebp
ret 0xc

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x401910
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov eax, dword [esp + 8]
mov dword [0x4040c0], eax
xor eax, eax
mov ebp, esp
mov ecx, 0xa
push eax
dec ecx
jne 0x401923
push esp
mov dword [ebp - 0x24], 0x401640
mov eax, dword [0x4040c0]
mov dword [ebp - 0x18], eax
mov dword [ebp - 4], str.zeenty
call dword [sym.imp.USER32.dll_RegisterClassA]
xor eax, eax
push eax
push dword [0x4040c0]
push eax
push eax
push 0x190
push 0x2b2
push 0x640
push 0x9c4
push 0
push str.upsent
push str.zeenty
push eax
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov dword [0x4040c8], eax
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
xor eax, eax
push eax
push eax
push eax
lea edx, [ebp - 0x1c]
push edx
call dword [sym.imp.USER32.dll_GetMessageA]
test eax, eax
je 0x4019c2
mov esi, dword [sym.imp.USER32.dll_TranslateMessage]
mov edi, dword [sym.imp.USER32.dll_DispatchMessageA]
lea eax, [ebp - 0x1c]
push eax
call esi
lea ecx, [ebp - 0x1c]
push ecx
call edi
xor eax, eax
push eax
push eax
push eax
lea edx, [ebp - 0x1c]
push edx
call dword [sym.imp.USER32.dll_GetMessageA]
test eax, eax
jne 0x4019a3
pop ebp
ret 0x10
Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x408f60
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, 0x407015
lea edi, [esi - 0x6015]
push edi
jmp 0x408f7a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x408f81
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x408f70
mov eax, 1
add ebx, ebx
jne 0x408f93
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x408f88
jne 0x408fa4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x408f88
xor ecx, ecx
sub eax, 3
jb 0x408fb8
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x40902a
mov ebp, eax
add ebx, ebx
jne 0x408fc3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x408fd0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x408ff4
inc ecx
add ebx, ebx
jne 0x408fe0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x408fd5
jne 0x408ff1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x408fd5
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x409014
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x409005
jmp 0x408f76
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x409014
add edi, ecx
jmp 0x408f76
pop esi
mov edi, esi
mov ecx, 0xe00
jmp 0x409065
mov al, byte [edi]
inc edi
cmp al, 0x80
jb 0x409045
cmp al, 0x8f
ja 0x409045
cmp byte [edi - 2], 0xf
je 0x40904b
sub al, 0xe8
cmp al, 1
ja 0x40906f
cmp ecx, 4
jb 0x409074
mov eax, dword [edi]
sub al, 8
jne 0x40906f
xchg ah, al
rol eax, 0x10
xchg ah, al
sub eax, edi
add eax, esi
sub ecx, 4
stosd dword es:[edi], eax
sub ecx, 1
jb 0x409074
mov al, byte [edi]
inc edi
jmp 0x409045
sub ecx, 1
jae 0x409034
lea edi, [esi + 0x6000]
mov eax, dword [edi]
or eax, eax
je 0x4090bc
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xa4f0]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xa5a0]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x40907a
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xa5a8]
or eax, eax
je 0x4090b6
mov dword [ebx], eax
add ebx, 4
jmp 0x409097
call dword [esi + 0xa5a4]
mov ebp, dword [esi + 0xa5ac]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x19f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x4090f0
sub esp, 0xffffff80
jmp 0x40106f
Function at 0x40d8b0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x9000]
push edi
or ebp, 0xffffffff
jmp 0x40d8d2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x40d8d9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x40d8c8
mov eax, 1
add ebx, ebx
jne 0x40d8eb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x40d8e0
jne 0x40d8fc
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x40d8e0
xor ecx, ecx
sub eax, 3
jb 0x40d910
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x40d982
mov ebp, eax
add ebx, ebx
jne 0x40d91b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x40d928
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x40d94c
inc ecx
add ebx, ebx
jne 0x40d938
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x40d92d
jne 0x40d949
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x40d92d
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x40d96c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x40d95d
jmp 0x40d8ce
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x40d96c
add edi, ecx
jmp 0x40d8ce
pop esi
lea edi, [esi + 0xb000]
mov eax, dword [edi]
or eax, eax
je 0x40d9d4
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xe164]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xe218]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x40d989
mov ecx, edi
jns 0x40d9b8
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xe21c]
or eax, eax
je 0x40d9ce
mov dword [ebx], eax
add ebx, 4
jmp 0x40d9a6
call dword [esi + 0xe22c]
mov ebp, dword [esi + 0xe220]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x20f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x40da08
sub esp, 0xffffff80
jmp 0x406aa8
Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x40a240
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x8000]
push edi
jmp 0x40a25a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x40a261
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x40a250
mov eax, 1
add ebx, ebx
jne 0x40a273
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x40a268
jne 0x40a284
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x40a268
xor ecx, ecx
sub eax, 3
jb 0x40a298
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x40a30a
mov ebp, eax
add ebx, ebx
jne 0x40a2a3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x40a2b0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x40a2d4
inc ecx
add ebx, ebx
jne 0x40a2c0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x40a2b5
jne 0x40a2d1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x40a2b5
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x40a2f4
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x40a2e5
jmp 0x40a256
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x40a2f4
add edi, ecx
jmp 0x40a256
pop esi
lea edi, [esi + 0x8000]
mov eax, dword [edi]
or eax, eax
je 0x40a353
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xbb6c]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xbbc4]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x40a311
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xbbcc]
or eax, eax
je 0x40a34d
mov dword [ebx], eax
add ebx, 4
jmp 0x40a32e
call dword [esi + 0xbbc8]
mov ebp, dword [esi + 0xbbd0]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1ff]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x40a387
sub esp, 0xffffff80
jmp 0x4014c4
Function at 0x401010
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov eax, 0x140c
call fcn.004235f0
mov eax, dword [0x450010]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov eax, dword [0x450054]
cmp eax, 0xffffffff
jne 0x401049
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004230e0
add esp, 0x140c
pop esi
pop edi
pop ebx
pop ebp
ret
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
test bl, 3
je 0x401034
and ebx, 0xfffffffc
lea eax, [ebp - 0x810]
push 0x800
push ebx
push eax
call sub.ntdll.dll_memcpy
add esp, 0xc
mov ecx, dword [0x450054]
lea eax, [ebp - 0x80f]
push eax
mov dword [ebp - 0x1418], ecx
push ecx
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
test ebx, ebx
je 0x401096
push ebx
call sub.mozglue.dll_void___cdecl_operator_delete___void__
add esp, 4
call fcn.004242b0
mov esi, eax
push eax
call dword [sym.imp.KERNEL32.dll_AcquireSRWLockExclusive]
lea eax, [ebp - 0x1410]
push 0xc00
push 0x450934
push eax
call sub.ntdll.dll_memcpy
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
mov ecx, 0x100
mov al, 1
lea edx, [ebp - 0x1408]
test al, 1
je 0x401122
mov dword [ebp - 0x1414], ecx
xor eax, eax
mov esi, edx
xor ebx, ebx
mov edi, dword [ebp + ebx*8 - 0x810]
test edi, edi
jne 0x4010fa
inc ebx
add esi, 0xc
cmp ebx, 0x100
jne 0x4010e1
jmp 0x401114
cmp dword [esi - 8], 0
je 0x4010ec
mov ecx, dword [ebp + ebx*8 - 0x80c]
cmp ecx, dword [esi]
jne 0x4010ec
mov ecx, dword [esi - 4]
test ecx, ecx
je 0x4010ec
jmp 0x401135
mov esi, dword [ebp - 0x1414]
lea ecx, [esi - 1]
cmp esi, 2
jae 0x4010d1
push 2
push dword [ebp - 0x1418]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
jmp 0x401034
mov dword [ebp + ebx*8 - 0x810], 0
call dword [section..00cfg]
push edi
call ecx
lea edx, [ebp - 0x1408]
add esp, 4
mov al, 1
jmp 0x4010ec