joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42c1d3
Capabilities:
Read file on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff4
mov esi, ecx
mov edi, edx
mov dword [esp], eax
xor ebp, ebp
test esi, esi
jbe 0x42c23f
mov ebx, 1
mov eax, esi
xor edx, edx
push edx
push eax
push 0
push 0x10000
call fcn.00415768
mov dword [esp + 4], eax
push 0
lea eax, [esp + 0xc]
push eax
mov eax, dword [esp + 0xc]
push eax
mov eax, edi
call fcn.00404bd8
lea eax, [eax + ebx - 1]
push eax
mov eax, dword [esp + 0x10]
push eax
call sub.kernel32.dll_ReadFile_1
test eax, eax
jne 0x42c20c
or ebp, 0xffffffff
add ebx, dword [esp + 8]
sub esi, dword [esp + 8]
xor eax, eax
call fcn.0041686c
cmp ebp, 0xffffffff
je 0x42c22b
mov eax, dword [edi]
call fcn.00404980
cmp ebx, eax
jle 0x42c1cd
mov eax, dword [edi]
call fcn.00404980
cmp ebx, eax
jle 0x42c23f
mov eax, dword [edi]
call fcn.00404980
mov ebp, eax
mov eax, ebp
add esp, 0xc
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x42d080
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff9c
push ebx
push esi
xor eax, eax
mov dword [ebp - 0x64], eax
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x60], eax
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], eax
xor eax, eax
push ebp
push 0x42d263
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x438f34], 0
jne 0x42d231
lea eax, [ebp - 0x50]
xor ecx, ecx
mov edx, 0x38
call fcn.00402f60
mov bl, 0x43
lea esi, [ebp - 0x50]
lea eax, [ebp - 0x54]
mov edx, ebx
call fcn.004048a8
mov edx, dword [ebp - 0x54]
lea eax, [ebp - 0x18]
mov ecx, 0x42d27c
call fcn.004049cc
mov eax, dword [ebp - 0x18]
call fcn.00404b80
push eax
call sub.kernel32.dll_GetDriveTypeA
cmp eax, 3
jne 0x42d19a
lea eax, [ebp - 0x10]
mov ecx, 0x42d288
mov edx, dword [ebp - 0x18]
call fcn.004049cc
mov eax, dword [ebp - 0x10]
call fcn.004086c0
test al, al
je 0x42d14c
push dword [ebp - 0x10]
push 0x42d298
push 0
push 0x2710
push 0
push 0x186a0
lea eax, [ebp - 0x58]
call fcn.00415d98
push dword [ebp - 0x58]
lea eax, [ebp - 0x10]
mov edx, 3
call fcn.00404a40
mov eax, dword [ebp - 0x10]
call fcn.004086e4
lea eax, [ebp - 0x14]
mov ecx, 0x42d2a8
mov edx, dword [ebp - 0x10]
call fcn.004049cc
push 0
push 0
xor ecx, ecx
mov edx, 0x42d2bc
mov eax, dword [ebp - 0x14]
call fcn.0041b42c
mov eax, dword [ebp - 0x14]
call fcn.004086b0
test al, al
je 0x42d18e
mov eax, dword [ebp - 0x10]
call fcn.0041b7e4
fstp qword [esi]
wait
xor ecx, ecx
xor edx, edx
mov eax, dword [ebp - 0x10]
call fcn.0041c0e4
inc ebx
add esi, 8
cmp bl, 0x46
jne 0x42d0d1
lea edx, [ebp - 0x60]
mov al, 1
call fcn.004190e4
mov eax, dword [ebp - 0x60]
lea edx, [ebp - 0x5c]
call fcn.00407fbc
mov eax, dword [ebp - 0x5c]
mov dl, byte [eax]
mov byte [ebp - 9], dl
xor eax, eax
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
mov bl, 0x43
lea ecx, [ebp - 0x50]
fld qword [ecx]
fcomp qword [ebp - 8]
fnstsw ax
sahf
jbe 0x42d1e9
mov eax, dword [ecx]
mov dword [ebp - 8], eax
mov eax, dword [ecx + 4]
mov dword [ebp - 4], eax
mov byte [ebp - 9], bl
inc ebx
add ecx, 8
cmp bl, 0x46
jne 0x42d1d1
cmp dl, byte [ebp - 9]
je 0x42d231
lea eax, [ebp - 0x64]
mov dl, byte [ebp - 9]
call fcn.004048a8
mov edx, dword [ebp - 0x64]
mov eax, 0x438f34
mov ecx, 0x42d2c8
call fcn.004049cc
mov eax, dword [0x438f34]
call fcn.004086c0
test al, al
je 0x42d231
mov eax, 0x438f34
mov edx, 0x42d298
call fcn.00404988
cmp dword [0x438f34], 0
setne bl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42d26a
lea eax, [ebp - 0x64]
mov edx, 5
call fcn.004046e4
lea eax, [ebp - 0x18]
mov edx, 3
call fcn.004046e4
ret
Function at 0x42fbd4
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push ebx
push esi
mov esi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404b70
xor eax, eax
push ebp
push 0x42fc61
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
lea eax, [ebp - 0x48]
xor ecx, ecx
mov edx, 0x44
call fcn.00402f60
mov dword [ebp - 0x48], 0x44
mov dword [ebp - 0x1c], 1
mov word [ebp - 0x18], si
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x48]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00404b80
push eax
push 0
call sub.kernel32.dll_CreateProcessA
cmp eax, 1
sbb eax, eax
inc eax
test al, al
je 0x42fc4b
mov ebx, dword [ebp - 0x58]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42fc68
lea eax, [ebp - 4]
call fcn.004046c0
ret
Function at 0x433748
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
xor eax, eax
push ebp
push 0x433844
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, 0x433858
call fcn.00423678
mov eax, dword [0x4390e8]
cmp dword [eax], 0
jg 0x43381f
lea eax, [ebp - 0xc]
call fcn.0042e25c
mov ecx, dword [ebp - 0xc]
lea eax, [ebp - 4]
mov edx, 0x433884
call fcn.004049cc
lea edx, [ebp - 0x14]
xor eax, eax
call fcn.004029a4
mov eax, dword [ebp - 0x14]
lea edx, [ebp - 0x10]
call fcn.00408a38
push dword [ebp - 0x10]
lea edx, [ebp - 0x18]
mov eax, dword [0x439064]
mov eax, dword [eax]
call fcn.00427954
push dword [ebp - 0x18]
push dword [ebp - 4]
lea eax, [ebp - 8]
mov edx, 3
call fcn.00404a40
lea eax, [ebp - 0x1c]
mov ecx, dword [ebp - 8]
mov edx, 0x4338ac
call fcn.004049cc
mov eax, dword [ebp - 0x1c]
call fcn.00423678
push 0
mov eax, dword [ebp - 8]
call fcn.00404b80
push eax
call sub.kernel32.dll_WinExec
push 0
push 0x3e8
xor eax, eax
call fcn.004168f4
mov eax, 0x4338c4
call fcn.00423678
push 0
push 0
push 2
mov eax, dword [0x438ff4]
mov eax, dword [eax]
push eax
call sub.user32.dll_PostMessageA
mov eax, 0x4338e8
call fcn.00423678
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43384b
lea eax, [ebp - 0x1c]
mov edx, 7
call fcn.004046e4
ret
Function at 0x434810
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x10], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4349ab
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x10]
xor eax, eax
call fcn.00418f0c
mov ecx, dword [ebp - 0x10]
mov dl, 1
mov eax, dword [0x426db0]
call fcn.00427598
call fcn.00427d58
mov dword [ebp - 0xc], eax
mov ebx, 0x46
mov eax, dword [ebp - 0xc]
add eax, 0xffffff4f
sub eax, 2
jae 0x434865
add ebx, 0x34
mov esi, 0x14
mov edi, 0x154
mov dword [ebp - 8], 0x12
push ebx
push esi
push edi
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
push 0
mov eax, dword [0x43a660]
push eax
push 0
mov edx, 0x4349bc
mov eax, 0x4349c0
mov ecx, 0x50000000
call fcn.00406ef0
mov edx, dword [0x439188]
mov dword [edx], eax
mov ebx, 0x46
mov esi, 0x26
mov edi, 0x188
mov dword [ebp - 8], 0xd
push 0x50000000
push ebx
push esi
push edi
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
push 0
mov eax, dword [0x43a660]
push eax
push 0
mov edx, 0x4349c8
xor ecx, ecx
xor eax, eax
call fcn.00406e98
mov edx, dword [0x43908c]
mov dword [edx], eax
mov ebx, 0x1a0
mov eax, dword [ebp - 0xc]
add eax, 0xffffff4f
sub eax, 2
jae 0x434904
mov ebx, 0x46
mov esi, 0x14
mov edi, 0x2e
mov dword [ebp - 8], 0xd
push 0x40000000
push ebx
push esi
push edi
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
push 0
mov eax, dword [0x43a660]
push eax
push 0
mov edx, 0x4349c8
xor ecx, ecx
xor eax, eax
call fcn.00406e98
mov edx, dword [0x439014]
mov dword [edx], eax
push 0
push 0x3e8
push 1
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_SetTimer
mov edx, dword [0x43904c]
mov dword [edx], eax
push 0x4349dc
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0xfffffffffffffff5
call sub.gdi32.dll_CreateFontA
push 0
push eax
push 0x30
mov eax, dword [0x439188]
mov eax, dword [eax]
push eax
call sub.user32.dll_SendMessageA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4349b2
lea eax, [ebp - 0x10]
call fcn.004046c0
ret
Function at 0x434c98
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa4
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x434e81
push dword fs:[eax]
mov dword fs:[eax], esp
push 0xffffffffffffffff
push 0xffffffffffffffff
mov eax, 0x434e98
call fcn.00419788
test eax, eax
jl 0x434cd6
neg eax
mov edx, dword [0x43910c]
mov dword [edx], eax
call sub.comctl32.dll_InitCommonControls
lea eax, [ebp - 0x54]
xor ecx, ecx
mov edx, 0x28
call fcn.00402f60
mov dword [ebp - 0x50], 0x434b1c
mov eax, dword [0x43a660]
mov dword [ebp - 0x44], eax
mov eax, dword [0x438f78]
call fcn.00404b80
mov dword [ebp - 0x30], eax
push 0x7f00
push 0
call sub.user32.dll_LoadCursorA
mov dword [ebp - 0x3c], eax
push 0x434ea4
mov eax, dword [0x43a660]
push eax
call sub.user32.dll_LoadIconA
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x54], 8
lea eax, [ebp - 0x54]
push eax
call sub.user32.dll_RegisterClassA
mov esi, 0x1ec
mov edi, 0x6e
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 4]
mov edx, edi
mov eax, esi
call fcn.0041a8ec
mov dword [ebp - 0xc], 0x2c80000
lea edx, [ebp - 0x58]
xor eax, eax
call fcn.00418f0c
mov ecx, dword [ebp - 0x58]
mov dl, 1
mov eax, dword [0x426db0]
call fcn.00427598
mov ebx, eax
lea eax, [ebp - 0x10]
push eax
mov ecx, 0x434eb8
mov edx, 0x434edc
mov eax, ebx
call fcn.00427c48
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebp - 8]
push eax
push esi
push edi
push 0
push 0
mov eax, dword [0x43a660]
push eax
push 0
mov eax, dword [ebp - 0x10]
call fcn.00404b80
push eax
mov eax, dword [0x438f78]
call fcn.00404b80
mov edx, eax
xor eax, eax
pop ecx
call fcn.00406e98
mov edx, dword [0x438ff4]
mov dword [edx], eax
lea edx, [ebp - 0x5c]
mov eax, ebx
call fcn.00427e50
mov eax, dword [ebp - 0x5c]
push eax
mov eax, ebx
call fcn.00427d58
push eax
mov eax, ebx
call fcn.00427dd0
mov edx, eax
pop ecx
pop eax
call fcn.0041e5b4
mov eax, dword [0x438ff4]
cmp dword [eax], 0
je 0x434e37
push 0
mov eax, dword [0x438ff4]
mov eax, dword [eax]
push eax
call sub.user32.dll_ShowWindow
jmp 0x434e24
lea eax, [ebp - 0x2c]
push eax
call sub.user32.dll_TranslateMessage
lea eax, [ebp - 0x2c]
push eax
call sub.user32.dll_DispatchMessageA
cmp byte [0x438f80], 0
jne 0x434e37
push 0
push 0
push 0
lea eax, [ebp - 0x2c]
push eax
call sub.user32.dll_GetMessageA
test eax, eax
jne 0x434e09
push 1
mov eax, dword [0x438ff4]
mov eax, dword [eax]
push eax
call sub.user32.dll_KillTimer
mov al, 1
call fcn.00422a0c
call fcn.004228d0
xor edx, edx
mov eax, 0x2b
call fcn.00423748
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x434e88
lea eax, [ebp - 0x5c]
mov edx, 2
call fcn.004046e4
lea eax, [ebp - 0x10]
call fcn.004046c0
ret
Function at 0x435114
Capabilities:
Copy file
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov ecx, 5
push 0
push 0
dec ecx
jne 0x43511c
xor eax, eax
push ebp
push 0x435228
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 4]
xor eax, eax
call fcn.004029a4
lea eax, [ebp - 0x10]
call fcn.0042cef4
push dword [ebp - 0x10]
push 0x43523c
push 0x435248
lea edx, [ebp - 0x14]
mov eax, dword [ebp - 4]
call fcn.00408ac0
push dword [ebp - 0x14]
lea eax, [ebp - 8]
mov edx, 4
call fcn.00404a40
push 0
mov eax, dword [ebp - 8]
call fcn.00404b80
push eax
mov eax, dword [ebp - 4]
call fcn.00404b80
push eax
call sub.kernel32.dll_CopyFileA
lea eax, [ebp - 0x18]
call fcn.004193b0
push dword [ebp - 0x18]
push 0x435254
lea edx, [ebp - 0x1c]
xor eax, eax
call fcn.004029a4
push dword [ebp - 0x1c]
push 0x43527c
lea eax, [ebp - 0xc]
mov edx, 4
call fcn.00404a40
push dword [ebp - 0xc]
push 0x43528c
lea edx, [ebp - 0x20]
xor eax, eax
call fcn.004029a4
push dword [ebp - 0x20]
push 0x4352a4
lea eax, [ebp - 0xc]
mov edx, 4
call fcn.00404a40
push 0
push dword [ebp - 8]
push 0x4352b0
lea edx, [ebp - 0x28]
mov eax, dword [ebp - 0xc]
call fcn.00408134
push dword [ebp - 0x28]
lea eax, [ebp - 0x24]
mov edx, 3
call fcn.00404a40
mov eax, dword [ebp - 0x24]
call fcn.00404b80
push eax
call sub.kernel32.dll_WinExec
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43522f
lea eax, [ebp - 0x28]
mov edx, 0xa
call fcn.004046e4
ret
Function at 0x4013e0
Capabilities:
Connect pipe

Disassembly:
push esi
push edi
push ebx
xor esi, esi
call dword [sym.imp.kernel32.dll_ConnectNamedPipe]
test eax, eax
jne 0x40142a
call dword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 0x217
je 0x40140a
cmp eax, 0x3e5
jne 0x40142a
mov esi, 1
jmp 0x401418
mov eax, dword [edi + 0x10]
push eax
call dword [sym.imp.kernel32.dll_SetEvent]
test eax, eax
je 0x40142a
push ebx
push str.olsnl5g6ovedhbpaxni3b9by
call fcn.0040100f
add esp, 8
mov eax, esi
pop esi
ret
call dword [sym.imp.kernel32.dll_GetLastError]
push eax
call fcn.00401f90
push eax
push str.lkmtltz2gpiv06buyx60hebjdwwjc
call fcn.0040100f
add esp, 0xc
xor eax, eax
pop esi
ret

Function at 0x401470
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
push ebx
push esi
push edi
push 0x40
mov esi, eax
lea eax, [ebp - 0x50]
push 0
push eax
call sub.msvcr90.dll_memset
mov ecx, dword [ebp + 8]
mov ebx, dword [sym.imp.msvcr90.dll__wcsdup]
xor eax, eax
push ecx
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
mov dword [ebp - 0x54], 0x44
call ebx
push esi
mov edi, eax
call ebx
push esi
mov ebx, eax
call fcn.00402110
mov esi, eax
add esp, 0x18
test esi, esi
jne 0x4014d2
push str.gy4ihzsly00zn32nntdyc1i3pr96xg9m7d124qte
call fcn.0040100f
add esp, 4
jmp 0x401548
push edi
push ebx
push str.an2df9tdn4ld7fyto024yefamvk9rb05lfh56oia3tpiszvbuy7qbu6wn5ebrzc3nj
call fcn.0040100f
add esp, 0xc
lea edx, [ebp - 0x10]
push edx
lea eax, [ebp - 0x54]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push edi
push ebx
call dword [sym.imp.kernel32.dll_CreateProcessW]
mov esi, eax
test esi, esi
jne 0x40151f
call dword [sym.imp.kernel32.dll_GetLastError]
push eax
call fcn.00401f90
push eax
push str.nvx9vu6xwhjz58wyo29q7oz6g8
call fcn.0040100f
add esp, 0xc
jmp 0x401548
mov ecx, dword [ebp - 8]
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp - 0x10]
mov dword [edx], ecx
mov ecx, dword [0x407138]
push eax
push ecx
call fcn.00401014
mov edx, dword [ebp - 8]
push edx
push str.Created_process_with_ID__ld_n
call fcn.0040100f
add esp, 0x10
push ebx
mov ebx, dword [sym.imp.msvcr90.dll_free]
call ebx
push edi
call ebx
add esp, 8
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x401770
Capabilities:
Create pipe

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push 0
push 0x1388
push 0x610
push 0x610
push 0xff
push 6
push 0x40040003
push eax
mov edi, ecx
call dword [sym.imp.kernel32.dll_CreateNamedPipeW]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x4017d1
call dword [sym.imp.kernel32.dll_GetLastError]
push eax
call fcn.00401f90
push eax
push str.2c9jw1257b9yfikeosh4efbxeva5
call fcn.0040100f
add esp, 0xc
push ebx
mov dword [edi], ebx
xor esi, esi
call dword [sym.imp.kernel32.dll_CloseHandle]
mov dword [edi], ebx
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret
push 0x10100180
push 6
push ebx
call fcn.004015a0
mov esi, eax
add esp, 0xc
test esi, esi
jne 0x40180c
push str.qc1fourdgj6ywhft8zsjiev2zttbh3jcxyw
call fcn.0040100f
add esp, 4
test ebx, ebx
je 0x40180c
push ebx
call dword [sym.imp.kernel32.dll_CloseHandle]
mov dword [edi], 0xffffffff
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret
mov dword [edi], ebx
mov edi, dword [ebp + 8]
call fcn.004013e0
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
push 4
nop
pop edi
nop
nop
nop
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x430072
mov ebx, 0x408ecc
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
div edi
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x3abb5324
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
nop
loop 0x430060
nop
nop
mov eax, section..data
cmp eax, 0
nop
nop
nop
je 0x4300d2
nop
nop
nop
nop
nop
mov ebx, 0x42e1d0
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x5706f5d
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
nop
loop 0x4300c0
nop
nop
nop
nop
popal
nop
nop
jmp 0x401219
Function at 0x441570
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x31000]
push edi
or ebp, 0xffffffff
jmp 0x441592
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x441599
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x441588
mov eax, 1
add ebx, ebx
jne 0x4415ab
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x4415a0
jne 0x4415bc
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4415a0
xor ecx, ecx
sub eax, 3
jb 0x4415d0
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x441642
mov ebp, eax
add ebx, ebx
jne 0x4415db
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x4415e8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x44160c
inc ecx
add ebx, ebx
jne 0x4415f8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x4415ed
jne 0x441609
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4415ed
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x44162c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x44161d
jmp 0x44158e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x44162c
add edi, ecx
jmp 0x44158e
pop esi
mov edi, esi
mov ecx, 0x117e
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x44164a
cmp byte [edi], 5
jne 0x44164a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x44164f
lea edi, [esi + 0x3f000]
mov eax, dword [edi]
or eax, eax
je 0x4416be
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x46e98]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x46f38]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x44167c
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x46f3c]
or eax, eax
je 0x4416b8
mov dword [ebx], eax
add ebx, 4
jmp 0x441699
call dword [esi + 0x46f44]
mov ebp, dword [esi + 0x46f40]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x21f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x4416f2
sub esp, 0xffffff80
jmp 0x41ba64

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43300c
pop eax
nop
nop
nop
nop
nop
add eax, 0x40a063
nop
sub eax, 0x40a009
nop
nop
nop
nop
mov ebx, dword [eax]
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
nop
nop
xor dword [ebx], edx
add ebx, 4
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
jl 0x433030
nop
nop
add eax, 0xc
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
nop
jne 0x43301e
nop
nop
nop
popal
nop
nop
nop
jmp 0x431219
Function at 0x430006
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
mov eax, section..text
nop
nop
nop
nop
push 4
nop
nop
nop
nop
pop edi
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x430072
nop
nop
nop
mov ebx, 0x408f6c
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x72814427
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
add eax, edi
nop
loop 0x430060
nop
nop
nop
nop
mov eax, section..data
cmp eax, 0
nop
nop
nop
nop
nop
nop
je 0x4300d2
nop
nop
mov ebx, 0x42e3d0
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
nop
mov esi, 0x4ef23b12
nop
nop
xor dword [eax], esi
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x4300c0
nop
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x401219

Function at 0x1002a986
Capabilities:
Access peb ldr_data

Disassembly:
lea esp, [esp + 0x34]
jne 0x10024987
dec ch
sar cl, cl
sub si, si
mov ecx, edi
pushfd
xor esi, 0x20048090
sub ecx, ebx
call fcn.100290a8
add byte [eax], al
push edx
push ecx
jne 0x10025135
jb 0x1002514b
push esi
popal
insb byte es:[edi], dx
jne 0x1002513c
inc ebp
js 0x10025131
add byte [eax], al
add byte [edi + 0x65], al
je 0x10025138
imul ebp, dword [esi + 0x64], 0x6854776f
jb 0x1002514f
popal
push eax
jb 0x1002515e
arpl word [ebp + 0x73], sp
jae 0x1002513d
add byte fs:[eax - 0x740a2805], al
cmp al, 0x8f
outsd dx, dword [esi]
insb byte es:[edi], dx
push 0x33706c65
insb byte es:[edi], dx
jo 0x1002516b
xor dl, byte [ebx + 0x6e]
popal
jo 0x100251b1
jae 0x100251a7
push 0x5500746f
outsd dx, dword [esi]
je 0x10025142
push ebp
call fcn.100291b3
invalid
arpl word [ecx + ebp*2 + 0x6f], si
ror byte [ebp - 0xf49880f], 0xcf
and dword ds:[0xb2301b66], 0x42f5b3ef
sbb si, word [eax]
mov dl, 0xef
mov bl, 0xf5
inc edx
push esi
jmp 0x100250a7
btc cx, 1
mov ecx, 0x104
bt bp, 7
stc
clc
xor al, al
cmc
push 0xb4344fe1
pushal
bt esi, 8
repne scasb al, byte es:[edi]
pushfd
jmp 0x100268b5

Function at 0x1002de05
Capabilities:
Authenticate hmac

Disassembly:
mov byte [esp + 8], 0x36
call fcn.10026359
add byte [eax], al
inc edi
je 0x1002de61
outsd dx, dword [esi]
arpl word [ecx + 0x6c], sp
dec ecx
outsb dx, byte [esi]
outsw dx, word [esi]
inc ecx
add dh, al
add al, 0x24
xchg ecx, eax
aad 0x57
add edx, eax
pushal
pushfd
lea esp, [esp + 0x2c]
jmp 0x1002700d
Function at 0x40792b
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0xa0]
sub esp, 0x120
mov eax, dword [0x478138]
xor eax, ebp
mov dword [ebp + 0x9c], eax
push esi
push 0x118
lea eax, [ebp - 0x7c]
push 0
push eax
call fcn.0043b390
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExW]
add esp, 0xc
lea eax, [ebp - 0x80]
push eax
mov dword [ebp - 0x80], 0x11c
call esi
test eax, eax
jne 0x407982
lea eax, [ebp - 0x80]
push eax
mov dword [ebp - 0x80], 0x114
call esi
test eax, eax
je 0x407990
cmp dword [ebp - 0x7c], 6
jb 0x407990
xor eax, eax
inc eax
cmp dword [ebp - 0x78], eax
jae 0x407992
xor eax, eax
mov ecx, dword [ebp + 0x9c]
xor ecx, ebp
pop esi
call fcn.0043b0c4
add ebp, 0xa0
leave
ret