joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41fd59
Capabilities:
Get file version info

Disassembly:
push 0xf0
mov eax, 0x4529a6
call fcn.0043c7da
mov eax, dword [ebp + 8]
push eax
mov esi, ebx
mov dword [ebp - 0x54], ebx
call fcn.00406f18
xor esi, esi
mov dword [ebp - 4], esi
mov dword [ebx + 0x1c], esi
mov dword [ebx + 0x20], esi
mov dword [ebx + 0x24], esi
mov byte [ebp - 4], 1
cmp dword [ebx + 0x14], 0x10
mov dword [ebp - 0x40], esi
jb 0x41fd95
mov eax, dword [ebx]
jmp 0x41fd97
mov eax, ebx
lea ecx, [ebp - 0x40]
push ecx
push eax
call dword [sym.imp.VERSION.dll_GetFileVersionInfoSizeA]
cmp eax, esi
jne 0x41fe4f
push str.System_error
mov dword [ebp - 0x4c], str.c:_workspace_8_2_build_windows_i586_cygwin_jdk8u181_11358_install_src_windows_common_FileUtils.cpp
mov dword [ebp - 0x48], str.VersionResource::VersionResource
mov dword [ebp - 0x44], 0x461
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
sub esp, 0x1c
mov esi, esp
mov dword [ebp - 0x50], esp
push ebx
call fcn.00406f18
lea eax, [ebp - 0xfc]
push eax
mov byte [ebp - 4], 2
call fcn.00409bf6
lea eax, [ebp - 0xfc]
push str.GetFileVersionInfoSize_
push eax
mov byte [ebp - 4], 3
call fcn.0040bad0
pop ecx
pop ecx
lea esi, [ebp - 0xfc]
mov byte [ebp - 4], 4
call fcn.0040b809
mov esi, eax
push 0x46140c
push esi
call fcn.0040bad0
pop ecx
pop ecx
mov ecx, dword [sym.imp.VERSION.dll_GetFileVersionInfoSizeA]
push esi
lea edi, [ebp - 0x60]
call fcn.0042503b
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x3c]
push ecx
lea esi, [ebp - 0x4c]
mov ecx, eax
call fcn.00419a34
lea eax, [ebp - 0x3c]
mov dword [esp], 0x466c7c
push eax
call fcn.0043c341
mov esi, eax
lea eax, [ebx + 0x1c]
call fcn.0040d4f9
mov ecx, dword [ebx + 0x1c]
mov eax, dword [ebx + 0x20]
sub eax, ecx
cmp dword [ebx + 0x14], 0x10
jb 0x41fe6b
mov edx, dword [ebx]
jmp 0x41fe6d
mov edx, ebx
mov edi, dword [sym.imp.VERSION.dll_GetFileVersionInfoA]
push ecx
push eax
push dword [ebp - 0x40]
push edx
call edi
test eax, eax
jne 0x41ff0b
push str.System_error
mov dword [ebp - 0x4c], str.c:_workspace_8_2_build_windows_i586_cygwin_jdk8u181_11358_install_src_windows_common_FileUtils.cpp
mov dword [ebp - 0x48], str.VersionResource::VersionResource
mov dword [ebp - 0x44], 0x46a
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
sub esp, 0x1c
mov esi, esp
mov dword [ebp - 0x50], esp
push ebx
call fcn.00406f18
lea eax, [ebp - 0xfc]
push eax
mov byte [ebp - 4], 6
call fcn.00409bf6
lea eax, [ebp - 0xfc]
push str.GetFileVersionInfo_
push eax
mov byte [ebp - 4], 7
call fcn.0040bad0
pop ecx
pop ecx
lea esi, [ebp - 0xfc]
mov byte [ebp - 4], 8
call fcn.0040b809
mov esi, eax
push 0x46140c
push esi
call fcn.0040bad0
pop ecx
pop ecx
mov ecx, edi
push esi
lea edi, [ebp - 0x60]
call fcn.0042503b
mov byte [ebp - 4], 9
jmp 0x41fe31
mov eax, ebx
call fcn.0043c85d
ret 4
Function at 0x421209
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4536a0
mov eax, dword fs:[0]
push eax
sub esp, 0x188
mov eax, dword [0x47162c]
xor eax, esp
mov dword [esp + 0x180], eax
push ebx
push esi
push edi
mov eax, dword [0x47162c]
xor eax, esp
push eax
lea eax, [esp + 0x198]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
lea eax, [esp + 0xec]
mov ebx, ecx
push eax
mov edi, esi
mov dword [esp + 0x18], ebx
call fcn.0041fa6a
pop ecx
xor edi, edi
push esi
lea eax, [esp + 0x10c]
mov dword [esp + 0x1a4], edi
call fcn.0041fb1e
pop ecx
xor eax, eax
inc eax
mov dword [esp + 0x1a0], eax
cmp dword [esp + 0xfc], edi
je 0x4212e1
push eax
lea eax, [esp + 0xf0]
push eax
lea edi, [esp + 0x148]
call fcn.004206ea
mov byte [esp + 0x1a0], 2
push dword [ebp + 0xc]
lea ecx, [esp + 0x10c]
push ecx
mov ecx, eax
call fcn.00421209
mov esi, edi
mov byte [esp + 0x1a0], 1
call fcn.0042076e
push 0
push 1
lea ecx, [esp + 0x110]
call fcn.00405e00
push 0
jmp 0x42145f
cmp dword [esi + 0x14], 0x10
jb 0x4212eb
mov ecx, dword [esi]
jmp 0x4212ed
mov ecx, esi
mov eax, dword [ebx]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push 4
lea edx, [ebp + 0xc]
push edx
push 4
push edi
push ecx
push eax
call ebx
mov dword [esp + 0x18], eax
cmp eax, edi
je 0x4213db
push str.set_dword_value
lea ecx, [esp + 0x128]
call fcn.00405b78
mov dword [esp + 0xe4], 0xf
mov dword [esp + 0xe0], edi
mov byte [esp + 0xd0], 0
push esi
lea eax, [esp + 0x128]
push eax
lea eax, [esp + 0x148]
push eax
push dword [esp + 0x20]
lea ecx, [esp + 0xe0]
mov byte [esp + 0x1b0], 4
call fcn.00421c98
mov edi, eax
lea esi, [esp + 0x34]
mov byte [esp + 0x1a0], 5
call fcn.004151a7
push str.System_error
push dword [esp + 0x1c]
mov eax, esi
push eax
mov ecx, ebx
lea edi, [esp + 0x34]
mov byte [esp + 0x1ac], 6
call fcn.0042503b
lea ecx, [esp + 0x168]
mov byte [esp + 0x1a0], 7
push ecx
lea esi, [esp + 0x20]
mov ecx, eax
mov dword [esp + 0x20], str.c:_workspace_8_2_build_windows_i586_cygwin_jdk8u181_11358_install_src_windows_common_Registry.cpp
mov dword [esp + 0x24], str.Registry::setDword
mov dword [esp + 0x28], 0x173
call fcn.00419a34
lea eax, [esp + 0x16c]
mov dword [esp], 0x466c7c
push eax
call fcn.0043c341
cmp dword [0x475304], edi
jg 0x42144f
mov eax, dword [esp + 0x14]
mov ecx, esi
lea esi, [esp + 0xd0]
call fcn.004209a6
lea ecx, [ebp + 0xc]
push ecx
push eax
lea eax, [esp + 0x12c]
push eax
mov byte [esp + 0x1ac], 8
call fcn.00421e10
add esp, 0xc
push str.Registry::setDword
push 0x176
push str.c:_workspace_8_2_build_windows_i586_cygwin_jdk8u181_11358_install_src_windows_common_Registry.cpp
push edi
mov edx, eax
mov ecx, 0x475304
mov byte [esp + 0x1b0], 9
call fcn.0041299a
push edi
push 1
lea ecx, [esp + 0x12c]
call fcn.00405e00
push edi
push 1
mov ecx, esi
call fcn.00405e00
push edi
push 1
lea ecx, [esp + 0x110]
call fcn.00405e00
push edi
push 1
lea ecx, [esp + 0xf4]
call fcn.00405e00
mov ecx, dword [esp + 0x198]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x180]
xor ecx, esp
call fcn.00434c4e
mov esp, ebp
pop ebp
ret 8
Function at 0x421b0c
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x11c
mov eax, dword [0x47162c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x3c]
push eax
mov ebx, ecx
call fcn.0041fa6a
pop ecx
push edi
lea eax, [ebp - 0x20]
call fcn.0041fb1e
xor esi, esi
pop ecx
cmp dword [ebp - 0x2c], esi
je 0x421bfc
mov ecx, dword [ebx + 8]
mov eax, dword [ebx]
push esi
or ecx, 0x2001f
push ecx
lea ecx, [ebp - 0x3c]
push ecx
push eax
lea eax, [ebp - 0x78]
push eax
call fcn.004204f4
mov esi, dword [ebp - 0x70]
add esp, 0x14
test esi, esi
je 0x421ba9
cmp byte [ebp - 0x74], 0
je 0x421b7e
push dword [ebp - 0x78]
mov byte [ebp - 0x74], 0
call fcn.0041dc38
pop ecx
push 0
push 1
lea ecx, [ebp - 0x20]
call fcn.00405e00
push 0
push 1
lea ecx, [ebp - 0x3c]
call fcn.00405e00
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.00434c4e
leave
ret 8
push 0x4740a9
lea eax, [ebp - 0x20]
push eax
push ecx
push ecx
mov ecx, dword [ebp - 0x78]
mov eax, esp
mov dword [eax], ecx
mov cl, byte [ebp - 0x74]
mov byte [eax + 4], cl
mov dword [ebp - 0x68], esp
push ebx
lea ecx, [ebp - 0x3c]
lea edi, [ebp - 0x64]
mov byte [ebp - 0x74], 0
call fcn.00420667
mov ecx, eax
call fcn.00421b0c
lea esi, [ebp - 0x64]
mov edi, eax
call fcn.0042076e
cmp byte [ebp - 0x74], 0
je 0x421bf8
push dword [ebp - 0x78]
mov byte [ebp - 0x74], 0
call fcn.0041dc38
pop ecx
mov esi, edi
jmp 0x421b7e
cmp dword [edi + 0x14], 0x10
jb 0x421c06
mov ecx, dword [edi]
jmp 0x421c08
mov ecx, edi
mov eax, dword [ebx]
push ecx
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov dword [ebp - 0x68], eax
cmp eax, esi
jne 0x421c90
cmp dword [0x475304], esi
jg 0x421c90
lea eax, [ebp - 0x118]
push eax
call fcn.00409bf6
lea eax, [ebp - 0x118]
push str.Deleted__
push eax
call fcn.0040bad0
sub esp, 0x14
mov ecx, edi
mov esi, esp
mov eax, ebx
mov dword [ebp - 0x7c], esp
call fcn.004209a6
lea esi, [ebp - 0x118]
call fcn.0040b809
mov esi, eax
push str.__value
push esi
call fcn.0040bad0
pop ecx
pop ecx
push esi
push 0x1c3
push 0
mov ebx, str.Registry::deleteValue
mov edi, str.c:_workspace_8_2_build_windows_i586_cygwin_jdk8u181_11358_install_src_windows_common_Registry.cpp
mov esi, 0x475304
call fcn.004078b0
lea eax, [ebp - 0x118]
call fcn.00407896
mov esi, dword [ebp - 0x68]
jmp 0x421b7e
Function at 0x425c35
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0x120
mov eax, 0x452cd2
call fcn.0043c7da
mov eax, dword [ebp + 8]
mov esi, ecx
mov dword [ebp - 0x78], eax
mov eax, esi
call fcn.00425c17
mov edi, eax
test edi, edi
jne 0x425ced
push str.cannot_find_resource
lea ecx, [ebp - 0x30]
call fcn.00405b78
and dword [ebp - 4], edi
lea eax, [ebp - 0x74]
push eax
lea edx, [ebp - 0x30]
mov ecx, esi
call fcn.00425b62
mov edi, eax
lea esi, [ebp - 0x12c]
mov byte [ebp - 4], 1
call fcn.004151a7
push str.System_error
mov byte [ebp - 4], 2
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
mov eax, esi
push eax
lea edi, [ebp - 0x90]
call fcn.0042503b
mov byte [ebp - 4], 3
mov dword [ebp - 0x84], str.c:_workspace_8_2_build_windows_i586_cygwin_jdk8u181_11358_install_src_windows_common_Resources.cpp
mov dword [ebp - 0x80], str.Resource::getPtr
mov dword [ebp - 0x7c], 0x41
lea ecx, [ebp - 0x58]
push ecx
lea esi, [ebp - 0x84]
mov ecx, eax
call fcn.00419a34
lea eax, [ebp - 0x58]
mov dword [esp], 0x466c7c
push eax
call fcn.0043c341
mov ebx, dword [sym.imp.KERNEL32.dll_LoadResource]
push edi
push dword [esi + 0x40]
call ebx
test eax, eax
jne 0x425d71
push str.cannot_load_resource
lea ecx, [ebp - 0x30]
call fcn.00405b78
lea eax, [ebp - 0x74]
push eax
lea edx, [ebp - 0x30]
mov ecx, esi
mov dword [ebp - 4], 4
call fcn.00425b62
mov edi, eax
lea esi, [ebp - 0x12c]
mov byte [ebp - 4], 5
call fcn.004151a7
push str.System_error
mov byte [ebp - 4], 6
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov eax, esi
push eax
mov ecx, ebx
lea edi, [ebp - 0x90]
call fcn.0042503b
mov byte [ebp - 4], 7
mov dword [ebp - 0x84], str.c:_workspace_8_2_build_windows_i586_cygwin_jdk8u181_11358_install_src_windows_common_Resources.cpp
mov dword [ebp - 0x80], str.Resource::getPtr
mov dword [ebp - 0x7c], 0x46
jmp 0x425ccc
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
cmp dword [esi + 0x3c], 6
mov ebx, eax
jne 0x425da1
mov esi, dword [esi + 0x1c]
and esi, 0xf
jbe 0x425d92
dec esi
movzx ecx, word [eax]
lea eax, [eax + ecx*2 + 2]
jne 0x425d88
movzx ecx, word [eax]
mov edx, dword [ebp - 0x78]
add ecx, ecx
mov dword [edx], ecx
lea ebx, [eax + 2]
jmp 0x425db0
push edi
push dword [esi + 0x40]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp - 0x78]
mov dword [ecx], eax
mov eax, ebx
call fcn.0043c85d
ret 4
Function at 0x42b12e
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x44f820
mov eax, dword fs:[0]
push eax
sub esp, 0x58
mov eax, dword [0x47162c]
xor eax, esp
mov dword [esp + 0x50], eax
push ebx
push esi
push edi
mov eax, dword [0x47162c]
xor eax, esp
push eax
lea eax, [esp + 0x68]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov edi, dword [eax + 4]
mov eax, dword [eax]
mov dword [esp + 0x1c], ecx
mov ecx, dword [ebp + 0xc]
xor ebx, ebx
push ecx
lea esi, [esp + 0x24]
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x18], eax
call fcn.00406f18
mov byte [esp + 0x3c], bl
mov dword [esp + 0x70], ebx
jmp 0x42b1db
lea edx, [esp + 0x20]
add edi, 0xfffffffc
mov ecx, dword [edi]
mov eax, dword [ecx]
push edx
lea edx, [esp + 0x44]
push edx
mov dword [esp + 0x20], edi
call dword [eax + 4]
mov esi, eax
lea edi, [esp + 0x20]
mov byte [esp + 0x70], 1
call fcn.00405ca7
mov al, byte [esi + 0x1c]
push ebx
push 1
lea ecx, [esp + 0x48]
mov byte [esp + 0x44], al
mov byte [esp + 0x78], bl
call fcn.00405e00
cmp byte [esp + 0x3c], bl
jne 0x42b1e1
mov edi, dword [esp + 0x18]
cmp edi, dword [esp + 0x14]
jne 0x42b192
mov esi, dword [esp + 0x1c]
lea eax, [esp + 0x20]
push eax
call fcn.00406f18
push ebx
push 1
lea ecx, [esp + 0x28]
call fcn.00405e00
mov eax, esi
mov ecx, dword [esp + 0x68]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x50]
xor ecx, esp
call fcn.00434c4e
mov esp, ebp
pop ebp
ret 8
Function at 0x42e4e6
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4510a5
mov eax, dword fs:[0]
push eax
sub esp, 0x38
push ebx
push esi
push edi
mov eax, dword [0x47162c]
xor eax, esp
push eax
lea eax, [esp + 0x48]
mov dword fs:[0], eax
xor ebx, ebx
lea esi, [esp + 0x14]
mov dword [esp + 0x14], ebx
call fcn.0042acb1
mov cl, byte [eax + 4]
mov edi, dword [eax]
mov byte [esp + 0x10], cl
mov dword [esp + 0x1c], edi
mov byte [eax + 4], bl
mov dword [esp + 0x2c], edi
mov byte [esp + 0x30], cl
mov dword [esp + 0x50], ebx
cmp byte [esp + 0x18], bl
je 0x42e551
push dword [esp + 0x14]
mov byte [esp + 0x1c], bl
call fcn.004339bb
pop ecx
mov dword [esp + 0x34], ebx
mov dword [esp + 0x38], ebx
mov dword [esp + 0x3c], ebx
mov esi, 0x100001
lea eax, [esp + 0x34]
mov byte [esp + 0x50], 1
call fcn.004140ac
push edi
mov edi, dword [esp + 0x38]
dec esi
push esi
push 1
push edi
call fcn.0043c046
add esp, 0x10
mov dword [esp + 0x14], eax
cmp eax, esi
jbe 0x42e5a5
push 0xc8
lea esi, [esp + 0x20]
call fcn.00424a48
push 0x466f8c
mov eax, esi
push eax
call fcn.0043c341
push dword [esp + 0x1c]
call fcn.0043bdd4
pop ecx
test eax, eax
je 0x42e5ca
push 0x133
lea esi, [esp + 0x20]
call fcn.00424a48
push 0x466f8c
mov eax, esi
jmp 0x42e59f
push dword [esp + 0x1c]
call fcn.0043bdac
pop ecx
test eax, eax
jne 0x42e5ef
push 0x13b
lea esi, [esp + 0x20]
call fcn.00424a48
push 0x466f8c
mov eax, esi
jmp 0x42e59f
mov esi, dword [esp + 0x14]
mov ecx, esi
mov eax, edi
call fcn.0042e4b2
lea eax, [edi + esi]
mov esi, dword [ebp + 8]
mov dword [esi + 0x14], 0xf
mov dword [esi + 0x10], ebx
mov byte [esi], bl
cmp edi, eax
je 0x42e61d
sub eax, edi
push eax
push edi
mov ecx, esi
call fcn.00405e63
cmp edi, ebx
je 0x42e628
push edi
call fcn.00434c43
pop ecx
cmp byte [esp + 0x10], bl
je 0x42e638
push dword [esp + 0x1c]
call fcn.004339bb
pop ecx
mov eax, esi
mov ecx, dword [esp + 0x48]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x42fc0d
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, dword [ebp + 0x10]
mov ebx, eax
xor ecx, ecx
cmp dword [ebp + 0x14], ecx
jl 0x42fc8d
jg 0x42fc39
cmp esi, ecx
jbe 0x42fc8d
cmp dword [ebp + 0x14], ecx
jg 0x42fc39
jl 0x42fc35
cmp esi, 0x7fffffff
jae 0x42fc39
mov eax, esi
jmp 0x42fc3e
mov eax, 0x7fffffff
cmp dword [ebp + 8], 0xffffffff
mov dword [ebp - 4], ecx
je 0x42fc7e
push ecx
lea ecx, [ebp - 4]
push ecx
push eax
push ebx
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x42fc68
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x6d
je 0x42fc88
jmp 0x42fc7e
mov eax, dword [ebp - 4]
test eax, eax
jle 0x42fc79
add ebx, eax
cdq
sub esi, eax
sbb dword [ebp + 0x14], edx
jmp 0x42fc19
cmp eax, 0xffffffff
jne 0x42fc88
call fcn.0043af75
cmp dword [eax], 4
je 0x42fc19
or eax, 0xffffffff
jmp 0x42fc8f
xor eax, eax
pop esi
pop ebx
leave
ret
Function at 0x434c4e
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x47162c]
jne 0x434c58
repz ret
jmp fcn.0043ef82

Function at 0x44a8ac
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x47162c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.004414f2
and dword [ebp - 0x14], 0
cmp dword [0x474ff8], 0
mov dword [ebp - 0x18], eax
jne 0x44a95f
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x44aa07
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x44aa07
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x474ff8], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x474ffc], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x475000], eax
call edi
push eax
call esi
mov dword [0x475008], eax
test eax, eax
je 0x44a95f
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x475004], eax
mov eax, dword [0x475004]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x44a9b8
cmp dword [0x475008], ecx
je 0x44a9b8
push eax
call esi
push dword [0x475008]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x44a9b8
test ebx, ebx
je 0x44a9b8
call edi
test eax, eax
je 0x44a9af
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x44a9af
test byte [ebp - 8], 1
jne 0x44a9b8
or dword [ebp + 0x10], 0x200000
jmp 0x44a9eb
mov eax, dword [0x474ffc]
cmp eax, dword [ebp - 0x18]
je 0x44a9eb
push eax
call esi
test eax, eax
je 0x44a9eb
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x44a9eb
mov eax, dword [0x475000]
cmp eax, dword [ebp - 0x18]
je 0x44a9eb
push eax
call esi
test eax, eax
je 0x44a9eb
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x474ff8]
call esi
test eax, eax
je 0x44aa07
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x44aa09
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00434c4e
leave
ret
Function at 0x421f20
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x15000]
push edi
or ebp, 0xffffffff
jmp 0x421f42
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x421f49
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x421f38
mov eax, 1
add ebx, ebx
jne 0x421f5b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x421f50
jne 0x421f6c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x421f50
xor ecx, ecx
sub eax, 3
jb 0x421f80
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x421ff2
mov ebp, eax
add ebx, ebx
jne 0x421f8b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x421f98
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x421fbc
inc ecx
add ebx, ebx
jne 0x421fa8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x421f9d
jne 0x421fb9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x421f9d
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x421fdc
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x421fcd
jmp 0x421f3e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x421fdc
add edi, ecx
jmp 0x421f3e
pop esi
mov edi, esi
mov ecx, 0x558
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x421ffa
cmp byte [edi], 5
jne 0x421ffa
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x421fff
lea edi, [esi + 0x1f000]
mov eax, dword [edi]
or eax, eax
je 0x422077
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x22238]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x222a4]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x42202c
mov ecx, edi
jns 0x42205b
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x222ac]
or eax, eax
je 0x422071
mov dword [ebx], eax
add ebx, 4
jmp 0x422049
call dword [esi + 0x222a8]
mov ebp, dword [esi + 0x222b0]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1ff]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x4220ab
sub esp, 0xffffff80
jmp 0x40473a
Function at 0x432001
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40c7d0
mov ecx, 0x7f9743ae
nop
nop
nop
nop
test eax, eax
nop
je 0x43204e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
nop
jne 0x432024
nop
mov eax, section..data
nop
mov ebx, 0x42f314
mov ecx, 0x31657c14
nop
nop
test eax, eax
nop
nop
nop
je 0x432084
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43206c
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x431219

Function at 0xfaf168
Capabilities:
Encode data using xor

Disassembly:
jmp 0xfaf172
pushal
call 0xfaf178
pop ebp
sub ebp, 0x10
sub ebp, 0xbaf168
jmp 0xfaf18e
mov eax, 0xbaf168
add eax, ebp
add eax, 0x4c
mov ecx, 0x5b7
mov edx, 0x8951244e
xor byte [eax], dl
inc eax
dec ecx
jne 0xfaf1a5
jmp 0xfaf1b8
lds eax, [ebx + 0x4e72c7c5]
dec esi
dec esi
iretd
Function at 0x401750
Capabilities:
Get storage device properties

Disassembly:
mov eax, 0x2c14
call fcn.004e6150
mov eax, dword [0x585520]
xor eax, esp
mov dword [esp + 0x2c10], eax
mov eax, dword [esp + 0x2c18]
push edi
xor edi, edi
mov dword [esp + 0xc], eax
cmp eax, edi
je 0x4018bb
cmp dword [esp + 0x2c20], edi
je 0x4018bb
push ebx
push ebp
mov ebp, dword [0x525314]
push esi
mov dword [esp + 0x10], edi
xor ebx, ebx
lea ebx, [ebx]
push ebx
push 0x5558d4
lea eax, [esp + 0x30]
push 0x100
push eax
call fcn.0049c7c4
add esp, 0x10
push edi
push edi
push 3
push edi
push 3
push edi
lea ecx, [esp + 0x40]
push ecx
call ebp
mov esi, eax
cmp esi, 0xffffffff
je 0x401894
xor eax, eax
push 0x2710
lea edx, [esp + 0x514]
push edi
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
push edx
mov dword [esp + 0x20], edi
mov dword [esp + 0x30], eax
mov dword [esp + 0x28], edi
mov dword [esp + 0x2c], edi
call fcn.004e2ec0
add esp, 0xc
push edi
lea eax, [esp + 0x18]
push eax
push 0x2710
lea ecx, [esp + 0x51c]
push ecx
push 0xc
lea edx, [esp + 0x30]
push edx
push 0x2d1400
push esi
call dword [0x525240]
test eax, eax
je 0x401887
push 0x3e8
lea eax, [esp + 0x12c]
push edi
push eax
call fcn.004e2ec0
mov edx, dword [esp + 0x534]
lea ecx, [esp + 0x134]
push ecx
push 1
push edx
lea eax, [esp + 0x528]
push eax
call fcn.00402e70
mov edx, dword [esp + 0x2c48]
mov eax, dword [esp + 0x34]
add esp, 0x1c
lea ecx, [esp + 0x128]
push ecx
push edx
push eax
call fcn.00401070
test eax, eax
jne 0x401887
mov dword [esp + 0x10], 1
push esi
call dword [0x525448]
cmp dword [esp + 0x10], edi
jne 0x40189e
inc ebx
cmp ebx, 0x10
jl 0x4017a0
mov eax, dword [esp + 0x10]
pop esi
pop ebp
pop ebx
pop edi
mov ecx, dword [esp + 0x2c10]
xor ecx, esp
call fcn.004e52c7
add esp, 0x2c14
ret
mov ecx, dword [esp + 0x2c14]
pop edi
xor ecx, esp
xor eax, eax
call fcn.004e52c7
add esp, 0x2c14
ret