joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40641e
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
push ebx
push esi
push edi
push dword [0x426664]
mov edi, dword [sym.imp.USER32.dll_SetCursor]
call edi
xor ebx, ebx
mov dword [ebp - 4], eax
mov dword [ebp - 0x40], 0x3c
mov dword [ebp - 0x3c], 0x440
mov dword [ebp - 8], ebx
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x34], str.runas
cmp dword [0x4268dc], ebx
jne 0x406464
mov dword [ebp - 0x34], str.open
mov eax, dword [ebp + 8]
mov esi, dword [sym.imp.KERNEL32.dll_CreateEventA]
push str.WinZip32_SETUP_CHROMERUNNING
push ebx
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 0xc]
push 1
push ebx
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x20], ebx
call esi
mov dword [ebp + 8], eax
cmp eax, ebx
jne 0x406499
push 0xb
pop eax
jmp 0x406539
cmp byte [0x426918], bl
je 0x4064d5
push str.WinZip32_SETUP_COURIER_GO_GO_GO
push ebx
push 1
push ebx
call esi
push str.WinZip32_SETUP_COURIER_SKIP_SKIP
push ebx
push 1
push ebx
mov dword [0x426920], eax
call esi
mov dword [0x426924], eax
cmp dword [0x426920], ebx
je 0x4064cd
cmp eax, ebx
jne 0x4064d5
mov byte [0x426918], bl
jmp 0x406491
lea eax, [ebp - 0x40]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
test eax, eax
je 0x406512
cmp byte [0x426918], bl
je 0x4064f7
mov eax, dword [ebp - 8]
mov dword [0x42691c], eax
xor eax, eax
jmp 0x406539
push 0xffffffffffffffff
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 4]
call edi
jmp 0x4064f3
push dword [ebp - 4]
call edi
push 0x30
push 0x3fd
call fcn.00408f47
pop ecx
push eax
push dword [ebp + 0x10]
call fcn.00408f47
pop ecx
push eax
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
or eax, 0xffffffff
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40748b
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1d4
push ebx
push esi
mov esi, dword [sym.imp.USER32.dll_SetCursor]
push edi
push dword [0x426664]
call esi
push 0x3c
pop edi
push edi
mov dword [ebp - 4], eax
xor ebx, ebx
lea eax, [ebp - 0x44]
push ebx
push eax
call fcn.00409ef0
mov dword [ebp - 0x44], edi
push str._kss
mov edi, 0x190
lea eax, [ebp - 0x1d4]
push edi
push eax
mov dword [ebp - 0x40], 0x440
mov dword [ebp - 0x34], str.wzglinst32.exe
mov dword [ebp - 8], ebx
call fcn.0040a6dc
add esp, 0x18
cmp dword [ebp + 8], ebx
je 0x40750b
push dword [ebp + 8]
call fcn.00409f90
pop ecx
test eax, eax
jbe 0x40750b
push dword [ebp + 8]
lea eax, [ebp - 0x1d4]
push edi
push eax
call fcn.0040a668
add esp, 0xc
lea eax, [ebp - 0x1d4]
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x38], str.runas
cmp dword [0x4268dc], ebx
jne 0x40752a
mov dword [ebp - 0x38], str.open
push str.WinZip32_SETUP_KAVRUNNING
push ebx
push 1
push ebx
mov dword [ebp - 0x28], ebx
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov edi, eax
cmp edi, ebx
jne 0x407565
push 0x30
push 0x3fd
call fcn.00408f47
pop ecx
push eax
push 0x436
call fcn.00408f47
pop ecx
push eax
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x4075c7
lea eax, [ebp - 0x44]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
test eax, eax
je 0x4075bb
push dword [ebp - 0xc]
call fcn.00403df3
pop ecx
push 0xffffffffffffffff
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea eax, [ebp - 8]
push eax
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
je 0x4075aa
mov eax, dword [ebp + 0xc]
cmp eax, ebx
je 0x4075aa
mov ecx, dword [ebp - 8]
and ecx, 0xffffff
mov dword [eax], ecx
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 4]
call esi
xor eax, eax
inc eax
jmp 0x4075c9
push dword [ebp - 4]
call esi
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x407992
Capabilities:
Create process on windows

Disassembly:
push ebx
push edi
push dword [0x426664]
mov edi, dword [sym.imp.USER32.dll_SetCursor]
call edi
push 1
push 0
push 0
push dword [esi + 4]
mov ebx, eax
push str.open
push dword [esi + 8]
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
push ebx
call edi
pop edi
pop ebx
ret

Function at 0x4079c1
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
push dword [edi + 0xc]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
mov esi, eax
inc esi
push esi
call fcn.0040aa0a
mov ebx, eax
pop ecx
test ebx, ebx
je 0x4079e7
push esi
push ebx
push dword [edi + 0xc]
call dword [sym.imp.USER32.dll_GetWindowTextA]
pop esi
mov eax, ebx
pop ebx
ret
Function at 0x408159
Capabilities:
Link many functions at runtime

Disassembly:
cmp byte [0x426f6c], 0
je 0x408183
cmp byte [0x426f6d], 0
je 0x408183
mov ecx, dword [0x426f68]
push 2
call fcn.00408efe
mov ecx, dword [0x426f68]
jmp 0x408d51
ret
push esi
mov esi, ecx
cmp byte [esi + 4], 0
je 0x408d5f
push 8
pop eax
pop esi
ret
mov eax, dword [esi]
test eax, eax
jne 0x408d69
push 2
jmp 0x408d5c
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.OCPRD189GetOfferType
push eax
call edi
test eax, eax
je 0x408de8
call eax
push str.OCPRD189PrepareDownload
push dword [esi]
call edi
test eax, eax
je 0x408de8
call eax
push str.OCPRD189GetOfferState
push dword [esi]
call edi
test eax, eax
je 0x408de8
call eax
cmp eax, 1
jne 0x408dbd
mov eax, dword [esi + 6]
cmp eax, 2
je 0x408dbd
cmp eax, 1
jne 0x408ded
push str.OCPRD189StartDLMgr2DownloadRunasAdmin
push dword [esi]
call edi
test eax, eax
je 0x408de8
call eax
push str.OCPRD189SignalProductInstalled
push dword [esi]
call edi
test eax, eax
je 0x408de8
call eax
push str.OCPRD189Detach
push dword [esi]
call edi
test eax, eax
je 0x408de8
call eax
push str.OCPRD189Shutdown
push dword [esi]
call edi
test eax, eax
jne 0x408df4
push 5
pop eax
jmp 0x408df8
push str.OCPRD189StartDLMgr2Download
jmp 0x408db3
call eax
xor eax, eax
pop edi
pop esi
ret
Function at 0x408184
Capabilities:
Create process on windows

Disassembly:
push ebp
lea ebp, [esp - 0x70]
sub esp, 0xb0
mov eax, dword [0x425250]
xor eax, ebp
mov dword [ebp + 0x6c], eax
mov eax, dword [ebp + 0x7c]
push ebx
push esi
mov esi, dword [sym.imp.USER32.dll_SetCursor]
push edi
push dword [0x426664]
mov edi, dword [ebp + 0x78]
mov dword [ebp - 4], eax
call esi
push 0x3c
pop ebx
push ebx
mov dword [ebp + 4], eax
lea eax, [ebp - 0x40]
push 0
push eax
call fcn.00409ef0
push str._opencandy
lea eax, [ebp + 8]
push 0x64
push eax
mov dword [ebp - 0x40], ebx
mov dword [ebp - 0x3c], 0x440
mov dword [ebp - 0x30], str.wzglinst32.exe
call fcn.0040a6dc
xor ebx, ebx
add esp, 0x18
cmp edi, ebx
je 0x408209
push edi
call fcn.00409f90
pop ecx
test eax, eax
jbe 0x408209
push edi
lea eax, [ebp + 8]
push 0x64
push eax
call fcn.0040a668
add esp, 0xc
lea eax, [ebp + 8]
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x34], str.runas
cmp dword [0x4268dc], ebx
jne 0x408225
mov dword [ebp - 0x34], str.open
push 0x41d3ac
push ebx
push 1
push ebx
mov dword [ebp - 0x24], ebx
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov edi, eax
cmp edi, ebx
jne 0x408260
push 0x30
push 0x3fd
call fcn.00408f47
pop ecx
push eax
push 0x437
call fcn.00408f47
pop ecx
push eax
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x4082c4
lea eax, [ebp - 0x40]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
test eax, eax
je 0x4082b8
push dword [ebp - 8]
call fcn.00403df3
pop ecx
push 0xffffffffffffffff
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea eax, [ebp]
push eax
push dword [ebp - 8]
mov dword [ebp], ebx
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
je 0x4082a8
mov eax, dword [ebp - 4]
cmp eax, ebx
je 0x4082a8
mov ecx, dword [ebp]
and ecx, 0xffffff
mov dword [eax], ecx
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp + 4]
call esi
mov al, 1
jmp 0x4082c6
push dword [ebp + 4]
call esi
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
mov ecx, dword [ebp + 0x6c]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00409ede
add ebp, 0x70
leave
ret
Function at 0x408718
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x1a0]
sub esp, 0x220
mov eax, dword [0x425250]
xor eax, ebp
mov dword [ebp + 0x19c], eax
mov eax, dword [ebp + 0x1a8]
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push edi
mov dword [ebp - 0x80], ecx
lea ecx, [ebp - 0x74]
push ecx
push 0x20119
xor edi, edi
push edi
push eax
push ebx
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x74], edi
mov dword [ebp - 0x7c], edi
call esi
cmp eax, edi
je 0x408775
lea eax, [ebp - 0x74]
push eax
push 0x20219
push edi
push dword [ebp - 0x78]
push ebx
call esi
cmp eax, edi
jne 0x4087bb
xor eax, eax
mov word [ebp - 0x70], ax
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp - 0x70]
push eax
push edi
push edi
push dword [ebp - 0x80]
mov dword [ebp - 0x78], 0x20a
push dword [ebp - 0x74]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4087b2
cmp word [ebp - 0x70], di
je 0x4087b2
lea eax, [ebp - 0x70]
push eax
call fcn.0040b57a
movzx eax, ax
pop ecx
mov dword [ebp - 0x7c], eax
push dword [ebp - 0x74]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp + 0x19c]
mov ax, word [ebp - 0x7c]
pop edi
xor ecx, ebp
pop esi
call fcn.00409ede
add ebp, 0x1a0
leave
ret
Function at 0x4087d6
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x1ac]
sub esp, 0x22c
mov eax, dword [0x425250]
xor eax, ebp
mov dword [ebp + 0x1a8], eax
mov eax, dword [ebp + 0x1b8]
mov ecx, dword [ebp + 0x1bc]
push ebx
xor ebx, ebx
mov dword [ebp - 0x70], eax
mov dword [ebp - 0x78], ecx
mov dword [ebp - 0x74], ebx
cmp word [ebp + 0x1b4], bx
jne 0x40882b
cmp ecx, ebx
je 0x408823
cmp dword [ebp + 0x1c0], ebx
je 0x408823
xor eax, eax
mov word [ecx], ax
xor eax, eax
inc eax
jmp 0x408957
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push edi
xor ecx, ecx
mov word [ebp + 0x194], cx
lea ecx, [ebp - 0x74]
push ecx
push 0x20119
push ebx
push eax
mov edi, 0x80000002
push edi
call esi
cmp eax, ebx
je 0x40886b
lea eax, [ebp - 0x74]
push eax
push 0x20219
push ebx
push dword [ebp - 0x70]
push edi
call esi
cmp eax, ebx
jne 0x408906
mov esi, dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
push 0x14
pop edi
xor eax, eax
mov word [ebp - 0x6c], ax
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp + 0x194]
push eax
push ebx
push ebx
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x6c]
push eax
push ebx
push dword [ebp - 0x74]
mov dword [ebp - 0x80], 0xff
mov dword [ebp - 0x7c], edi
call esi
test eax, eax
jne 0x4088fd
mov dword [ebp - 0x70], ebx
xor eax, eax
mov word [ebp + 0x190], ax
lea eax, [ebp - 0x6c]
push eax
call fcn.0040b57a
pop ecx
cmp ax, word [ebp + 0x1b4]
je 0x4088fd
xor eax, eax
inc dword [ebp - 0x70]
mov word [ebp - 0x6c], ax
mov word [ebp + 0x194], ax
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp + 0x194]
push eax
push ebx
push ebx
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x6c]
push eax
push dword [ebp - 0x70]
mov dword [ebp - 0x80], 0xff
push dword [ebp - 0x74]
mov dword [ebp - 0x7c], edi
call esi
test eax, eax
je 0x4088a6
push dword [ebp - 0x74]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
cmp dword [ebp - 0x78], ebx
je 0x40894b
cmp dword [ebp + 0x1c0], ebx
je 0x40894b
cmp word [ebp + 0x194], bx
je 0x408930
xor eax, eax
mov word [ebp + 0x1a6], ax
lea eax, [ebp + 0x194]
push eax
jmp 0x408935
push 0x41d3d8
push dword [ebp + 0x1c0]
push dword [ebp - 0x78]
call fcn.0040a01b
add esp, 0xc
jmp 0x408823
xor eax, eax
cmp word [ebp + 0x194], bx
setne al
mov ecx, dword [ebp + 0x1a8]
xor ecx, ebp
pop ebx
call fcn.00409ede
add ebp, 0x1ac
leave
ret

Function at 0x409105
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0xa0
mov eax, dword [0x425250]
xor eax, ebp
mov dword [ebp + 0x74], eax
push 0x98
lea eax, [ebp - 0x24]
push 0
push eax
mov dword [ebp - 0x28], 0x9c
call fcn.00409ef0
add esp, 0xc
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
jne 0x409146
xor al, al
jmp 0x409163
cmp dword [ebp - 0x24], 5
jb 0x409142
jbe 0x409152
mov al, 1
jmp 0x409163
xor eax, eax
inc eax
cmp dword [ebp - 0x20], eax
jae 0x409163
cmp word [ebp + 0x6c], 3
sbb al, al
inc al
mov ecx, dword [ebp + 0x74]
xor ecx, ebp
call fcn.00409ede
add ebp, 0x78
leave
ret
Function at 0x409172
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x90]
sub esp, 0x110
mov eax, dword [0x425250]
xor eax, ebp
mov dword [ebp + 0x8c], eax
push ebx
xor ebx, ebx
push esi
mov esi, dword [ebp + 0x9c]
cmp esi, ebx
mov byte [ebp - 0x75], bl
mov dword [ebp - 0x7c], ebx
je 0x4091a5
fldz
fstp qword [esi]
lea eax, [ebp - 0x7c]
push eax
mov eax, dword [ebp + 0x98]
push 0x20019
neg eax
push ebx
sbb eax, eax
push str.SoftwareMozillaMozilla_Firefox
add eax, 0x80000002
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x409228
push 0xff
lea eax, [ebp - 0x73]
push ebx
push eax
mov byte [ebp - 0x74], bl
call fcn.00409ef0
add esp, 0xc
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x74]
push eax
push ebx
push ebx
push str.CurrentVersion
push dword [ebp - 0x7c]
mov dword [ebp - 0x80], 0x100
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x40921a
cmp esi, ebx
je 0x409216
lea eax, [ebp - 0x74]
push eax
call fcn.0040d76e
fstp qword [esi]
pop ecx
mov byte [ebp - 0x75], 1
push dword [ebp - 0x7c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp byte [ebp - 0x75], bl
jne 0x40923c
cmp dword [ebp + 0x98], ebx
jne 0x40923c
push esi
push 1
call fcn.00409172
pop ecx
pop ecx
jmp 0x40923f
mov al, byte [ebp - 0x75]
mov ecx, dword [ebp + 0x8c]
pop esi
xor ecx, ebp
pop ebx
call fcn.00409ede
add ebp, 0x90
leave
ret
Function at 0x409ede
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x425250]
jne 0x409ee8
repz ret
jmp fcn.0040d983

Function at 0x40a744
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 8], esi
jne 0x40a775
call fcn.0040e03a
mov dword [eax], esi
call fcn.0040e027
push esi
push esi
push esi
push esi
push esi
mov dword [eax], 0x16
call fcn.0040dfbf
add esp, 0x14
push 0x16
pop eax
jmp 0x40a7ca
test dword [ebp + 0xc], 0xfffffff9
jne 0x40a751
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x40a7a2
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0040e04d
pop ecx
call fcn.0040e027
mov eax, dword [eax]
jmp 0x40a7ca
test al, 0x10
jne 0x40a7c8
test al, 1
je 0x40a7c8
test byte [ebp + 0xc], 2
je 0x40a7c8
call fcn.0040e03a
mov dword [eax], 5
call fcn.0040e027
mov dword [eax], 0xd
jmp 0x40a799
xor eax, eax
pop esi
pop ebp
ret

Function at 0x4167cd
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0040eaea
and dword [ebp - 4], 0
cmp dword [0x427f3c], 0
mov ebx, eax
jne 0x41687e
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x41692f
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x4219bc
push edi
call esi
test eax, eax
je 0x41692f
push eax
call fcn.0040ea78
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x427f3c], eax
call esi
push eax
call fcn.0040ea78
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x427f40], eax
call esi
push eax
call fcn.0040ea78
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x427f44], eax
call esi
push eax
call fcn.0040ea78
pop ecx
mov dword [0x427f4c], eax
test eax, eax
je 0x41687e
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0040ea78
pop ecx
mov dword [0x427f48], eax
mov eax, dword [0x427f48]
cmp eax, ebx
je 0x4168d6
cmp dword [0x427f4c], ebx
je 0x4168d6
push eax
call fcn.0040eaf3
push dword [0x427f4c]
mov esi, eax
call fcn.0040eaf3
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x4168d6
test edi, edi
je 0x4168d6
call esi
test eax, eax
je 0x4168cd
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x4168cd
test byte [ebp - 0xc], 1
jne 0x4168d6
or dword [ebp + 0x10], 0x200000
jmp 0x41690f
mov eax, dword [0x427f40]
cmp eax, ebx
je 0x41690f
push eax
call fcn.0040eaf3
pop ecx
test eax, eax
je 0x41690f
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x41690f
mov eax, dword [0x427f44]
cmp eax, ebx
je 0x41690f
push eax
call fcn.0040eaf3
pop ecx
test eax, eax
je 0x41690f
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x427f3c]
call fcn.0040eaf3
pop ecx
test eax, eax
je 0x41692f
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x416931
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0xe22104
Capabilities:
Encode data using xor

Disassembly:
jmp 0xe2210e
pushal
call 0xe22114
pop ebp
sub ebp, 0x10
sub ebp, 0xa22104
jmp 0xe2212a
mov eax, 0xa22104
add eax, ebp
add eax, 0x4c
mov ecx, 0x5d9
mov edx, 0xaf04ed35
xor byte [eax], dl
inc eax
dec ecx
jne 0xe22141
jmp 0xe22154
add byte [eax], al
inc ebp
mov es, edx
mov bh, 0xbe
clc
mov esi, 0x353509bc
xor eax, 0x35cdf4b4
mov esi, 0x9bcbef8
xor eax, 0xf4b43535
int 0x35
xor eax, 0x8df83635
xor esi, dword [0x1d8f3535]
xor eax, 0xd7c23535
std
mov esi, 0x353539b4
xor eax, 0x6565f036
pop ebp
pop ecx
out 0x14, eax
xor eax, 0xb57bad5d
xor eax, 0x5d111934
push ebp
jno 0xe2214e
pop ebx
fnsave dword [eax]
xor eax, 0x1dc3535
xor eax, 0x51b83535
adc ecx, ecx
mov esp, 0xd9be1119
mov esi, 0x35353db0
xor eax, 0x3539a0be
xor eax, 0x25b8be35
xor eax, 0xdcf43535
aaa
add al, 0x37
mov dh, 0xf7
xor dword [edx + edi - 0x50], edi
ror edx, 0xca
retf 0x19be
Function at 0x4b3e60
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x71000]
push edi
jmp 0x4b3e7a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x4b3e81
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4b3e70
mov eax, 1
add ebx, ebx
jne 0x4b3e93
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x4b3ea4
jne 0x4b3ec3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4b3ec3
dec eax
add ebx, ebx
jne 0x4b3eb0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x4b3e88
add ebx, ebx
jne 0x4b3ebf
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x4b3f15
xor ecx, ecx
sub eax, 3
jb 0x4b3edb
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x4b3f4a
sar eax, 1
mov ebp, eax
jmp 0x4b3ee6
add ebx, ebx
jne 0x4b3ee6
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4b3eb4
inc ecx
add ebx, ebx
jne 0x4b3ef4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4b3eb4
add ebx, ebx
jne 0x4b3f01
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x4b3ef6
jne 0x4b3f12
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4b3ef6
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x4b3f34
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x4b3f26
jmp 0x4b3e76
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x4b3f34
add edi, ecx
jmp 0x4b3e76
pop esi
mov edi, esi
mov ecx, 0x379b
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x4b3f52
cmp byte [edi], 0x13
jne 0x4b3f52
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x4b3f57
lea edi, [esi + 0xaf000]
mov eax, dword [edi]
or eax, eax
je 0x4b3fcf
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xb5e94]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xb5fe8]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x4b3f84
mov ecx, edi
jns 0x4b3fb3
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xb5fec]
or eax, eax
je 0x4b3fc9
mov dword [ebx], eax
add ebx, 4
jmp 0x4b3fa1
call dword [esi + 0xb5ffc]
mov ebp, dword [esi + 0xb5ff0]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x217]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x4b4003
sub esp, 0xffffff80
jmp 0x4165c1
Function at 0x4d02b0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x83000]
push edi
jmp 0x4d02ca
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x4d02d1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4d02c0
mov eax, 1
add ebx, ebx
jne 0x4d02e3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x4d02f4
jne 0x4d0313
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4d0313
dec eax
add ebx, ebx
jne 0x4d0300
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x4d02d8
add ebx, ebx
jne 0x4d030f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x4d0365
xor ecx, ecx
sub eax, 3
jb 0x4d032b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x4d039a
sar eax, 1
mov ebp, eax
jmp 0x4d0336
add ebx, ebx
jne 0x4d0336
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4d0304
inc ecx
add ebx, ebx
jne 0x4d0344
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4d0304
add ebx, ebx
jne 0x4d0351
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x4d0346
jne 0x4d0362
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4d0346
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x4d0384
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x4d0376
jmp 0x4d02c6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x4d0384
add edi, ecx
jmp 0x4d02c6
pop esi
mov edi, esi
mov ecx, 0x3e3b
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x4d03a2
cmp byte [edi], 0x1a
jne 0x4d03a2
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x4d03a7
lea edi, [esi + 0xcd000]
mov eax, dword [edi]
or eax, eax
je 0x4d041f
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xe417c]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xe42a8]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x4d03d4
mov ecx, edi
jns 0x4d0403
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xe42ac]
or eax, eax
je 0x4d0419
mov dword [ebx], eax
add ebx, 4
jmp 0x4d03f1
call dword [esi + 0xe42bc]
mov ebp, dword [esi + 0xe42b0]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x20f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x4d0453
sub esp, 0xffffff80
jmp 0x46205f