joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46bc8a
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
sar ecx, 6
push esi
push edi
imul edi, eax, 0x38
mov eax, dword [ecx*4 + 0x488110]
mov dword [ebp - 0x10], ecx
mov ecx, dword [eax + edi + 0x18]
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x46bcca
cmp byte [ebx], 0xa
jne 0x46bcca
or byte [eax + edi + 0x28], 4
jmp 0x46bccf
and byte [eax + edi + 0x28], 0xfb
add ecx, ebx
mov edx, ebx
mov dword [ebp - 0xc], ecx
mov esi, ebx
cmp ebx, ecx
jae 0x46bdcd
mov al, byte [edx]
cmp al, 0x1a
je 0x46bdaf
lea ecx, [edx + 1]
mov dword [ebp - 8], ecx
mov ecx, dword [ebp - 0xc]
cmp al, 0xd
je 0x46bcfe
mov edx, dword [ebp - 8]
mov byte [esi], al
jmp 0x46bd23
mov eax, dword [ebp - 8]
cmp eax, ecx
jae 0x46bd2d
mov cl, byte [eax]
xor eax, eax
cmp cl, 0xa
sete al
inc eax
add edx, eax
cmp cl, 0xa
sete al
dec al
and al, 3
add al, 0xa
mov byte [esi], al
mov ecx, dword [ebp - 0xc]
inc esi
cmp edx, ecx
jb 0x46bce0
jmp 0x46bdcd
push 0
lea eax, [ebp - 0xc]
push eax
push 1
lea eax, [ebp - 1]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x46bdaa
cmp dword [ebp - 0xc], 0
je 0x46bdaa
mov ecx, dword [ebp - 0x10]
mov eax, dword [ecx*4 + 0x488110]
test byte [eax + edi + 0x28], 0x48
je 0x46bd84
mov dl, byte [ebp - 1]
lea eax, [esi + 1]
mov dword [ebp - 0x14], eax
cmp dl, 0xa
jne 0x46bd6f
mov byte [esi], dl
jmp 0x46bd80
mov byte [esi], 0xd
mov eax, dword [ecx*4 + 0x488110]
mov byte [eax + edi + 0x2a], dl
mov eax, dword [ebp - 0x14]
mov esi, eax
jmp 0x46bdcd
cmp byte [ebp - 1], 0xa
jne 0x46bd93
cmp esi, ebx
jne 0x46bd93
mov byte [esi], 0xa
jmp 0x46bdcc
push 1
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.004015f5
add esp, 0x10
cmp byte [ebp - 1], 0xa
je 0x46bdcd
mov byte [esi], 0xd
jmp 0x46bdcc
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ecx*4 + 0x488110]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x46bdc9
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x46bdcd
mov byte [esi], 0x1a
inc esi
sub esi, ebx
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x46be29
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov ebx, eax
and eax, 0x3f
sar ebx, 6
push edi
imul edi, eax, 0x38
push 0xa
mov eax, dword [ebx*4 + 0x488110]
pop edx
mov dword [ebp - 0x14], edx
mov ecx, dword [edi + eax + 0x18]
mov dword [ebp - 0x18], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x46be6c
cmp word [esi], dx
jne 0x46be6c
or byte [edi + eax + 0x28], 4
jmp 0x46be71
and byte [edi + eax + 0x28], 0xfb
lea edx, [esi + ecx*2]
mov eax, esi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
cmp eax, edx
jae 0x46bfc4
mov dword [ebp - 0xc], 0xd
movzx ecx, word [eax]
mov edx, ecx
mov dword [ebp - 0x10], edx
push 0x1a
pop edx
cmp cx, dx
mov edx, dword [ebp - 8]
je 0x46bfa4
add eax, 2
cmp cx, word [ebp - 0xc]
je 0x46beb3
mov dword [ebp - 4], eax
mov word [esi], cx
jmp 0x46bee9
cmp eax, edx
jae 0x46bef5
movzx eax, word [eax]
xor ecx, ecx
cmp ax, word [ebp - 0x14]
mov edx, eax
push 0xa
sete cl
xor eax, eax
lea ecx, [ecx*2 + 2]
add dword [ebp - 4], ecx
pop ecx
cmp dx, cx
mov edx, dword [ebp - 8]
sete al
dec eax
and eax, 3
add eax, ecx
mov word [esi], ax
mov eax, dword [ebp - 4]
add esi, 2
cmp eax, edx
jb 0x46be8b
jmp 0x46bfc4
push 0
lea eax, [ebp - 0x14]
push eax
push 2
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x46bfa0
cmp dword [ebp - 0x14], 0
je 0x46bfa0
mov eax, dword [ebx*4 + 0x488110]
push 0xa
test byte [edi + eax + 0x28], 0x48
je 0x46bf78
mov dx, word [ebp - 4]
lea eax, [esi + 2]
pop ecx
mov dword [ebp - 0x18], eax
cmp dx, cx
jne 0x46bf41
mov word [esi], cx
jmp 0x46bf74
push 0xd
pop eax
mov word [esi], ax
mov eax, dword [ebx*4 + 0x488110]
movzx ecx, dx
shr ecx, 8
push 0xa
mov byte [edi + eax + 0x2a], dl
mov eax, dword [ebx*4 + 0x488110]
mov byte [edi + eax + 0x2b], cl
mov eax, dword [ebx*4 + 0x488110]
pop ecx
mov byte [edi + eax + 0x2c], cl
mov eax, dword [ebp - 0x18]
mov esi, eax
jmp 0x46bfc4
pop ebx
cmp word [ebp - 4], bx
jne 0x46bf89
cmp esi, dword [ebp + 0xc]
jne 0x46bf89
mov word [esi], bx
jmp 0x46bfc1
push 1
push 0xffffffffffffffff
push 0xfffffffffffffffe
push dword [ebp + 8]
call fcn.004015f5
add esp, 0x10
cmp word [ebp - 4], bx
je 0x46bfc4
push 0xd
jmp 0x46bfbd
mov ecx, dword [ebx*4 + 0x488110]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x46bfbb
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x46bfc4
push 0x1a
pop eax
mov word [esi], ax
add esi, 2
sub esi, dword [ebp + 0xc]
and esi, 0xfffffffe
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x462c2c
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push ebx
push esi
push edi
mov edi, dword [ebp + 0x10]
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
xor eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x10]
mov edx, esi
mov eax, ebx
call sym.DJ_4428.dll_Is_NewCard
dec eax
jl 0x462e3e
cmp dword [ebp - 0x10], 1
jne 0x462c74
push 0
push 0
push esi
push ebx
call sym.DJ_4428.dll_DJ_Write_FirstSection
dec eax
jl 0x462e3e
jmp 0x462c83
mov eax, dword [ebp - 0x14]
and eax, 4
cmp eax, 4
je 0x462e3e
mov edx, esi
mov eax, ebx
call fcn.00456298
dec eax
jl 0x462e3e
push esi
push ebx
call sub.MWIC_32.DLL_auto_init
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jle 0x462e3e
xor ecx, ecx
push ebp
push 0x462e37
push dword fs:[ecx]
mov dword fs:[ecx], esp
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.MWIC_32.dll_get_status
movsx eax, ax
test eax, eax
je 0x462cd3
call fcn.00403a40
jmp 0x462e3e
mov eax, dword [ebp - 8]
push eax
call sub.MWIC_32.dll_chk_4428
movsx eax, ax
test eax, eax
je 0x462ced
call fcn.00403a40
jmp 0x462e3e
lea eax, [ebp - 0x57]
push eax
push 1
push 0x308
mov eax, dword [ebp - 8]
push eax
call sub.MWIC_32.dll_srd_4428
movsx eax, ax
test eax, eax
je 0x462d12
call fcn.00403a40
jmp 0x462e3e
mov al, byte [ebp - 0x57]
and al, 4
cmp al, 4
je 0x462d44
add byte [ebp - 0x57], 4
lea eax, [ebp - 0x57]
push eax
push 1
push 0x308
mov eax, dword [ebp - 8]
push eax
call sub.MWIC_32.dll_swr_4428
movsx eax, ax
test eax, eax
je 0x462d44
call fcn.00403a40
jmp 0x462e3e
mov byte [ebp - 0x57], 0xa2
mov byte [ebp - 0x56], 0x14
mov byte [ebp - 0x55], 0x11
mov byte [ebp - 0x54], 0x29
call fcn.00402988
mov ebx, 4
lea esi, [ebp - 0x53]
mov eax, 0xff
call fcn.00402c38
mov byte [esi], al
inc esi
dec ebx
jne 0x462d61
mov eax, edi
mov ecx, 0xf4240
cdq
idiv ecx
mov ebx, edx
mov eax, ebx
mov ecx, 0x2710
cdq
idiv ecx
call fcn.00456d08
mov byte [ebp - 0x4f], al
mov eax, edi
mov ecx, 0x2710
cdq
idiv ecx
mov ebx, edx
mov eax, ebx
mov ecx, 0x64
cdq
idiv ecx
call fcn.00456d08
mov byte [ebp - 0x4e], al
mov eax, ebx
mov ecx, 0x64
cdq
idiv ecx
mov eax, edx
call fcn.00456d08
mov byte [ebp - 0x4d], al
mov ebx, 4
lea esi, [ebp - 0x4c]
mov eax, 0xff
call fcn.00402c38
mov byte [esi], al
inc esi
dec ebx
jne 0x462dc9
xor eax, eax
mov ebx, 0xf
lea edx, [ebp - 0x57]
xor ecx, ecx
mov cl, byte [edx]
add eax, ecx
inc edx
dec ebx
jne 0x462de3
add al, 0x33
and eax, 0xff
mov byte [ebp - 0x48], al
lea eax, [ebp - 0x57]
push eax
push 0x10
push 0x3a0
mov eax, dword [ebp - 8]
push eax
call sub.MWIC_32.dll_swr_4428
movsx eax, ax
test eax, eax
je 0x462e19
call fcn.00403a40
jmp 0x462e3e
mov dword [ebp - 4], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x462e3e
mov eax, dword [ebp - 8]
push eax
call sub.MWIC_32.dll_ic_exit
ret
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x41154c
Capabilities:
Decompress data using aplib

Disassembly:
push ebp
mov ebp, esp
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
cld
mov dl, 0x80
movsb byte es:[edi], byte [esi]
call fcn.004115cb
jae 0x411558
xor ecx, ecx
call fcn.004115cb
jae 0x411582
xor eax, eax
call fcn.004115cb
jae 0x411593
mov al, 0x10
call fcn.004115cb
adc al, al
jae 0x411574
jne 0x4115c0
stosb byte es:[edi], al
jmp 0x411559
call fcn.004115d7
dec ecx
loop 0x41159f
mov eax, ebp
call fcn.004115d5
jmp 0x4115c1
lodsb al, byte [esi]
shr eax, 1
je 0x4115e7
adc ecx, 2
mov ebp, eax
jmp 0x4115c1
xchg ecx, eax
dec eax
shl eax, 8
lodsb al, byte [esi]
mov ebp, eax
call fcn.004115d5
cmp eax, 0x7d00
jae 0x4115bf
cmp eax, 0x500
jae 0x4115c0
cmp eax, 0x7f
ja 0x4115c1
inc ecx
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x411559
pop ebp
ret 8
Function at 0x6027af
Capabilities:
Encode data using xor

Disassembly:
add byte [edx + 0x14], al
jbe 0x602766
push 0x3c
sahf
xchg ecx, eax
rol dword [ebp - 0x52044619], cl
invalid
invalid
mov ch, 0xe3
shr dword [esi + ebp + 0x78], 0x1a
inc esp
push es
push eax
std
mov edi, 0x97d58be9
shl ebx, 0x4b
or dword [edi + 0x3d], ebx
arpl word [ecx], sp
ja 0x602756
ficomp dword [eax - 0x4f0d5332]
out 0xc4, al
imul ebp, dword [ebx], 0x3411f7d
push ebp
idiv eax
mov edx, 0x92d08eec
invalid
xor dword [edi - 0x2b], edi
jnp 0x6027cd
xchg edi, eax
dec ebp
jecxz 0x602739
dec edi
lds ebp, [ebx + 9]
xchg dword [ebp - 0xd], ebx
xchg ecx, eax
fbstp tbyte [ebp - 0x25]
mov ecx, 0x2143ed37
out dx, eax
movsd dword es:[edi], dword [esi]
or ebp, dword [ecx - 0x19]
cmp eax, 0x15bff193
mov ebx, 0x238d57d9
inc ecx
pop dword [ebp + 0x1dc7492b]
mov bl, 0xd1
lahf
xor eax, 0x7b2f42fa
and eax, 0x3d085c71
imul eax, dword [eax + edx*2], 0xa3f75a0e
fisttp dword [edi - 0x4317491e]
xchg ecx, eax
lds ebp, [edx + 0x3e]
push ebx
pop es
pop ecx
or eax, 0xd88cf4a0
mov ch, 0xe1
mov edi, 0xa792c6eb
sahf
retf 0xc094

Function at 0x604ec7
Capabilities:
Encode data using xor

Disassembly:
push ecx
push cs
enter 0xada, 0xffffffffffffffa0
shr dword [esi], cl
in al, dx
sbb byte [esi*2 + 0x4b8502ee], bh
jb 0x604ece
cmp al, 0x75
out dx, al
add al, byte [ebp + 0x6520724b]
lahf
lahf
xchg edi, eax
push ecx
dec edi
push esp
mov ah, 1
movsb byte es:[edi], byte [esi]
aam 0xf7
xor edi, ebp
adc al, 0xeb
sub edi, esp
jnp 0x604ea6
dec esi
in eax, 0xd6
movsd dword es:[edi], dword [esi]
in al, 0xe9
sub byte [ebp + 0x15b75595], ah
mov ebp, 0x7c9a3a32
jb 0x604e9c
xor bh, byte [edx]
lcall 0xe57d, 0x68c8727c
pmullw mm0, qword [esi - 0x580cea94]
push 0xd50fe57d
xchg byte [ebp + edx - 0xd], ch
cmpsd dword [esi], dword es:[edi]
repe cmpsd dword [esi], dword es:[edi]
mov ch, 0xe3
add ah, dl
out 0x83, eax
inc edi
push ss
mov dl, 0x4b
sahf
dec ebx
retf 0x2216
Function at 0x62d5cb
Capabilities:
Encode data using xor

Disassembly:
sahf
or al, 0x28
int 0xd3
mov al, 1
dec esi
xor edx, dword [ecx + 0x23]
add byte [edi - 0x6f], bh
mov esp, 0xff7d02d0
int 0xe1
inc byte [edi + 0x3934b3dc]
aad 0x92
outsb dx, byte [esi]
in al, dx
mov al, byte [0xb9d2be52]
xchg ebx, eax
invalid
outsd dx, dword [esi]
fld xword [eax - 0x38467711]
in eax, 0xc2
iretd
les esi, [esi + 0x12a2e4ad]
les ecx, [ebx + 0x67]
push cs
jns 0x62d650
jns 0x62d582
push eax
rcl dword [eax + 1], cl
push edx
pop ecx
fild dword [ecx - 0x6e31f68]
pop esi
iretd
xor esi, dword [0x7c903b73]
lodsb al, byte [esi]
in eax, 0x6e
mov dl, 3
pushal
sbb eax, 0x7316d4cc
out dx, al
aam 0x16
jae 0x62d602
punpcklbw mm1, dword [esi - 0x5493d80b]
pop edi
adc cl, dl
push ss
enter 0x5d8a, 0x22
push edx
cmp esi, dword [0xb626aa3]
bound ecx, qword [ebx]
shr dword [ecx - 0x16], 1
jne 0x62d695
mov ch, byte [esi + 0x71]
dec esi
daa
mov ah, 0x5c
and dh, cl
jno 0x62d69e
or eax, dword [eax - 0x4d]
sbb byte [ebx + 0x22], dh
out dx, al
imul dword [edi + 0x54]
lodsd eax, dword [esi]
sti
mov dh, pe_nt_image_headers32
mov ebx, 0xeb2d1df9
mov dword [0x96554d97], eax
push ebp
xchg esi, eax
movsd dword es:[edi], dword [esi]
inc eax
push eax
loope 0x62d628
mov bh, 0x4b
ja 0x62d610
mov bl, 0x51
pop ebp
insb byte es:[edi], dx
or ch, 0xf0
das
sal dword [ebx], 0xcd
dec edx
pop ecx
rol byte [edi + esi*4 + 0x7e5901fd], 1
sub al, 0x60
and eax, 0x7c202c18
shr dword [eax + esi*2 - 0x6f], 0xf9
stosd dword es:[edi], eax
ja 0x62d667
iretd
movsd dword es:[edi], dword [esi]
rcr byte [ecx], cl
imul edi
dec edi
into
inc ecx
pop ebp
scasb al, byte es:[edi]
jle 0x62d6cf
cmp dword [ecx - 0x74], esi
jno 0x62d624
sahf
and eax, 0x30a30ed7
arpl word [ebx + 0xd593ec6], sp
out dx, al
ja 0x62d68a
jns 0x62d71f
lea ebp, [ecx - 0x43]
xchg ebp, eax
rcl ebx, 1
out 0x16, eax
outsd dx, dword [esi]
and eax, 0x3319c048
rcr byte [ecx], 0x33
and dword [ebx - 0x16], edx
wait
xor al, 0x2c
clc
jae 0x62d716
imul ebx, dword [ebx], 0x6f
out 0xd1, eax
and edx, dword [0xdbace333]
jge 0x62d68f
sal ebx, 0xa0
sub eax, 0xc57cf5f
cdq
mov al, byte [0x57cf5f2d]
mov al, byte [0x57cf5f2d]
or al, 0x99
sti
jo 0x62d6cd
nop
xchg ebx, eax
rcl byte [edi + ebp - 0x71320459]
stosd dword es:[edi], eax
xor dword [edx + 0x1a], edx
invalid
pop ecx
sal dword [ebx - 0x63], cl
pop es
and ecx, dword [ebp + 0x14a72b30]
mov byte ss:[0xea93743f], al
mov ecx, 0xd96f79f
cld
mov byte [0x9fbb381e], al
jne 0x62d6b0
aas
je 0x62d6b5
ljmp 0xfc0d:0x96f79fb9
mov dword [0xf76de71e], eax
xor byte [ebp + 0x52], 0xe4
pop esi
jae 0x62d77e
jae 0x62d712
pop edi
popal
dec ebp
sub edi, dword [esi]
les esi, [edx - 0x5c1a1c8b]
mov esi, 0x15e49e93
in al, 0x15
in eax, 0xc1
xor esi, dword [ecx + 0x24]
cmpsb byte [esi], byte es:[edi]
xor al, 0x30
jle 0x62d74c
inc edx
xchg ecx, eax
adc eax, dword [ebp + 0x4bf53363]
mov esp, cs
mov al, byte [0xa2f26fd9]
xor ebx, dword [ebx]
cdq
or al, 0xb1
rcl dword [ebx - 1], cl
push ebp
cld
or al, 0x70
fist dword [ecx + 0x12]
invalid
mov dl, 0x2e
salc
add dword [ebx - 0x39e77408], ecx
xrelease xchg byte [edx + 0x142c2ad6], dh
clc
or byte [edi], 0xe
cli
test eax, 0x11140d2
jmp 0x62bb0c
Function at 0x658194
Capabilities:
Get file version info

Disassembly:
add bh, bh
and eax, sym.imp.VERSION.dll_GetFileVersionInfoSizeW
jmp dword [sym.imp.VERSION.dll_GetFileVersionInfoW]

Function at 0xa98c41
Capabilities:
Accept command line arguments

Disassembly:
mov dx, word [ecx]
jmp 0xb0863d
push ebp
mov ebp, esp
add ebp, 4
push ebx
mov ebx, 0x7a5f512a
sub ebx, 0x7a5f5126
sub ebp, ebx
pop ebx
xchg dword [esp], ebp
pop esp
mov dword [esp], edx
mov dword [esp], eax
pop dword [ebp - 4]
push eax
mov eax, esp
push esi
push 4
pop esi
add eax, esi
mov esi, dword [esp]
add esp, 4
sub eax, 4
xchg dword [esp], eax
pop esp
mov dword [esp], eax
push ebx
push dword [esp]
pop eax
push esi
mov esi, esp
push ebp
mov ebp, 0x7e44d550
sub ebp, 0x7e44d54c
add esi, ebp
pop ebp
add esi, 4
xchg dword [esp], esi
pop esp
push dword [esp]
pop eax
push ebp
mov ebp, esp
push eax
mov eax, 4
add ebp, eax
pop eax
add ebp, 4
xor ebp, dword [esp]
xor dword [esp], ebp
xor ebp, dword [esp]
pop esp
jmp 0xa9c645
push dword [ebp - 4]
mov ecx, dword [esp]
push 0x100e872c
mov dword [esp], edi
push esp
pop edi
add edi, 4
add edi, 4
xchg dword [esp], edi
pop esp
push esi
mov dword [esp], 0x3f107bff
mov dword [esp], edi
push edi
mov edi, 0x27be3228
mov dword [esp + 4], edi
pop edi
mov dword [esp], ecx
sub ecx, 0x2dbedcf5
push ebp
mov ebp, 0x7fbf5d6b
xor ebp, 0x35f7a574
dec ebp
or ebp, 0x5cffd8f3
sub ebp, 0xe10e60f8
sub ecx, ebp
pop ebp
sub ecx, 0x77ee3d31
add ecx, eax
add ecx, 0x77ee3d31
push ebx
mov ebx, 0x648f32ea
and ebx, 0x5fffa17d
dec ebx
or ebx, 0x7bf9d86a
and ebx, 0x2bd928ff
add ebx, 0x52186f98
add ecx, ebx
pop ebx
add ecx, 0x2dbedcf5
mov ecx, dword [esp]
push ebp
mov dword [esp], edi
mov edi, esp
push edx
mov edx, 4
add edi, 0x3cde09da
add edi, edx
sub edi, 0x3cde09da
pop edx
add edi, 4
xchg dword [esp], edi
pop esp
jmp 0xaeca0f
je 0xb074b0
jmp 0xaeae68
jmp 0xab12a9
push ebx
sub esp, 4
mov dword [esp], esp
add dword [esp], 4
pop ebx
add ebx, 4
sub ebx, 4
xchg dword [esp], ebx
mov esp, dword [esp]
mov dword [esp], ebx
push ecx
mov ebx, dword [esp]
sub esp, 4
mov dword [esp], eax
mov eax, esp
add eax, 4
push ebp
mov ebp, 4
add eax, ebp
pop ebp
xchg dword [esp], eax
pop esp
push dword [esp]
pop ebx
push esi
mov esi, esp
add esi, 4
push ecx
mov ecx, 0x65527740
dec ecx
add ecx, 0x9aad88c5
sub esi, 0x7b3e9084
add esi, ecx
add esi, 0x7b3e9084
pop ecx
xchg dword [esp], esi
pop esp
xor edx, edx
jmp 0xa93bec
sub esp, 4
mov dword [esp], esi
push ebx
mov ebx, 0x12473c4a
mov dword [esp + 4], ebx
mov ebx, dword [esp]
add esp, 4
mov dword [esp], eax
sub esp, 4
mov dword [esp], edx
mov dword [esp], eax
mov dword [esp], ebx
mov eax, dword [esp]
add esp, 4
mov eax, dword [esp]
push ebx
push esp
pop ebx
add ebx, 4
push ebp
mov ebp, 4
add ebx, ebp
pop ebp
xchg dword [esp], ebx
mov esp, dword [esp]
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
jmp fcn.00a932de
cmp edx, dword [ebp - 0xc]
jmp 0xabb948
Function at 0x4039c1
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
pushal
call 0x4039d0
pop dword [ebp - 0x44]
mov eax, 0xee222543
sub eax, 0xede1eb73
sub dword [ebp - 0x44], eax
mov dword [ebp - 0x54], 0xb4fd8f74
sub dword [ebp - 0x54], 0x66ab4a29
mov dword [ebp - 0x50], 0xc0cdac40
add dword [ebp - 0x50], 0x7165a005
mov dword [ebp - 0x4c], 0x83ded0e1
add dword [ebp - 0x4c], 0xc86d734d
mov dword [ebp - 0x48], 0x7c9fbf8d
add dword [ebp - 0x48], 0x83604073
lea eax, [ebp - 0x54]
push eax
mov eax, 0xabf3ce00
add eax, 0x544c7284
add eax, dword [ebp - 0x44]
call dword [eax]
mov dword [ebp - 0x54], 0xa5eb60d7
add dword [ebp - 0x54], 0xce87087f
mov dword [ebp - 0x50], 0x7fa6d878
sub dword [ebp - 0x50], 0x3e3a7703
mov dword [ebp - 0x4c], 0x6d924a6e
sub dword [ebp - 0x4c], 0xa22de02
mov dword [ebp - 0x48], 0x5d8c2fbc
add dword [ebp - 0x48], 0xa273d044
lea ebx, [ebp - 0x54]
push ebx
push eax
mov eax, 0x24321293
sub eax, 0x23f1d20b
add eax, dword [ebp - 0x44]
call dword [eax]
push 0x40
push 0x1000
push 0x38234
push 0
call eax
mov ecx, 0x3138f119
add ecx, 0xcec75c9b
mov edi, eax
mov ebx, 0x408800
add ebx, dword [ebp - 0x44]
mov esi, 0x4c37eaa1
sub esi, 0x9dd22023
xor dword [ebp - 0x3c], 0x2de2775d
mov edx, dword [ebx]
add dword [ebp - 0x2c], ecx
add edx, esi
mov dword [ebp - 0x10], 0x398ac0a3
mov dword [edi], edx
mov dword [ebp - 0x14], 0x639401a1
add edi, 0x73d622ab
add edi, 0x8c29dd59
add ebx, 0xaf5276a8
sub ebx, 0xaf5276a4
loop 0x403aec
add eax, 0x54289570
add eax, 0xabd89433
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0xf7118579
sub ecx, 0xf6d18579
add ecx, dword [ebp - 0x44]
call ebx
leave
ret

Function at 0x42e002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
call 0x42e00c
nop
nop
nop
nop
nop
pop eax
nop
add eax, 0x403ac5
sub eax, 0x403a6b
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
jl 0x42e030
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
nop
nop
jne 0x42e01e
nop
popal
nop
nop
nop
nop
jmp loc.00401219

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x4d0529
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push 0x40
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp + 0xc]
push eax
call fcn.004d0480
add esp, 0xc
mov eax, dword [ebp + 0xc]
xor ecx, ecx
mov cx, word [eax]
cmp ecx, 0x5a4d
je 0x4d0558
mov eax, 0xea61
jmp 0x4d05d6
mov eax, dword [ebp + 0xc]
cmp dword [eax + 0x3c], 0
jne 0x4d0568
mov eax, 0xea62
jmp 0x4d05d6
push 0xf8
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 0x3c]
add eax, dword [ebp + 8]
push eax
mov eax, dword [ebp + 0x10]
push eax
call fcn.004d0480
add esp, 0xc
mov eax, dword [ebp + 0x10]
cmp dword [eax], 0x4550
je 0x4d0595
mov eax, 0xea62
jmp 0x4d05d6
mov eax, dword [ebp + 0x10]
xor ecx, ecx
mov cx, word [eax + 4]
cmp ecx, 0x14c
je 0x4d05ad
mov eax, 0xea65
jmp 0x4d05d6
mov eax, dword [ebp + 0x10]
xor ecx, ecx
mov cx, word [eax + 0x16]
test ch, 0x10
je 0x4d05c2
mov eax, 0xea66
jmp 0x4d05d6
mov eax, dword [ebp + 0x10]
cmp dword [eax + 0x74], 0x10
jbe 0x4d05d2
mov eax, 0xea67
jmp 0x4d05d6
xor eax, eax
jmp 0x4d05d6
pop edi
pop esi
pop ebx
leave
ret
Function at 0x1bc5d20
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x154d000]
push edi
or ebp, 0xffffffff
jmp 0x1bc5d42
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x1bc5d49
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x1bc5d38
mov eax, 1
add ebx, ebx
jne 0x1bc5d5b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x1bc5d6c
jne 0x1bc5d8b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x1bc5d8b
dec eax
add ebx, ebx
jne 0x1bc5d78
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x1bc5d50
add ebx, ebx
jne 0x1bc5d87
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x1bc5ddd
xor ecx, ecx
sub eax, 3
jb 0x1bc5da3
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x1bc5e12
sar eax, 1
mov ebp, eax
jmp 0x1bc5dae
add ebx, ebx
jne 0x1bc5dae
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x1bc5d7c
inc ecx
add ebx, ebx
jne 0x1bc5dbc
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x1bc5d7c
add ebx, ebx
jne 0x1bc5dc9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x1bc5dbe
jne 0x1bc5dda
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x1bc5dbe
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x1bc5dfc
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x1bc5dee
jmp 0x1bc5d3e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x1bc5dfc
add edi, ecx
jmp 0x1bc5d3e
pop esi
mov edi, esi
mov ecx, 0x19ccf
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x1bc5e1a
cmp byte [edi], 0x87
jne 0x1bc5e1a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x1bc5e1f
lea edi, [esi + 0x17c1000]
mov eax, dword [edi]
or eax, eax
je 0x1bc5e97
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x17c6c9c]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x17c6e18]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x1bc5e4c
mov ecx, edi
jns 0x1bc5e7b
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x17c6e1c]
or eax, eax
je 0x1bc5e91
mov dword [ebx], eax
add ebx, 4
jmp 0x1bc5e69
call dword [esi + 0x17c6e24]
mov ebp, dword [esi + 0x17c6e20]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x267]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x1bc5ecb
sub esp, 0xffffff80
jmp 0x78bbe8
Function at 0x42e002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
mov eax, section..rdata
nop
nop
nop
nop
nop
push 4
nop
nop
nop
pop edi
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x42e072
nop
nop
mov ebx, 0x407ef8
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
mov esi, 0x1cc919e0
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x42e060
mov eax, section._RDATA
nop
nop
nop
cmp eax, 0
nop
je 0x42e0d2
nop
nop
nop
nop
nop
mov ebx, 0x42cd70
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
div edi
nop
nop
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
mov esi, 0x41132e60
nop
nop
nop
xor dword [eax], esi
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x42e0c0
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x401219