joyce8/EMBER2024-capa huggingface dataset:
Function at 0x423c19
Capabilities:
Hide graphical window

Disassembly:
and dword [0x45587c], 0
push 1
push dword [esp + 8]
mov byte [0x455871], 1
mov byte [0x455872], 1
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
push 2
push dword [esp + 0xc]
call fcn.00401cc4
cmp dword [0x4496c0], 0
jne 0x423c59
cmp byte [0x45587b], 0
je 0x423c62
cmp dword [0x455874], 0
jne 0x423c75
push 0
push 1
push 0x111
push dword [esp + 0x10]
call dword [sym.imp.USER32.dll_SendMessageW]
ret 4

Function at 0x423d64
Capabilities:
Set registry value

Disassembly:
push 0x2c
mov eax, 0x439ea2
call fcn.004257d8
cmp byte [0x45537c], 0
mov esi, dword [ebp + 8]
je 0x423e4b
cmp dword [0x455390], 0
je 0x423e4b
xor edi, edi
mov dword [ebp - 0x14], 7
xor eax, eax
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x18], edi
mov word [ebp - 0x28], ax
lea eax, [ebp - 0x28]
mov dword [ebp - 4], edi
push eax
push 0x455380
call fcn.00421ceb
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0x2c]
push eax
push edi
push 0x20006
push edi
push edi
push edi
push str.SoftwareWinRAR_SFX
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x423e10
cmp dword [esi + 0x14], 8
mov ecx, esi
jb 0x423de2
mov ecx, dword [esi]
cmp dword [ebp - 0x14], 8
lea edx, [ebp - 0x28]
jb 0x423dee
mov edx, dword [ebp - 0x28]
mov eax, dword [esi + 0x10]
lea eax, [eax*2 + 2]
push eax
push ecx
push 1
push edi
push edx
push dword [ebp - 0x2c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x2c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x14]
cmp eax, 8
jb 0x423e4b
mov ecx, dword [ebp - 0x28]
lea eax, [eax*2 + 2]
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x34], ecx
cmp eax, 0x1000
jb 0x423e42
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x34]
push eax
call fcn.004019a9
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x34]
push eax
push ecx
call fcn.00425726
pop ecx
pop ecx
call fcn.00425787
ret 4
Function at 0x4269c9
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x426a08
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x426a08
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x426a08
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x426a08
cmp dword [ecx + 0x74], 0xe
jbe 0x426a08
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x438db0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x438ddd
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x438ddd
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x40e8e5
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
push 0
mov edi, 0x80
push edi
push 3
push 0
lea ebx, [ecx + 4]
push 1
mov dword [ebp - 8], ecx
mov esi, 0x40000000
push esi
mov ecx, ebx
call fcn.00406087
push eax
call fcn.0040f3a5
cmp eax, 0xffffffff
mov dword [ebp - 4], eax
je 0x40e94b
push 2
push 0
push 0
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x40e946
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x40e946
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or eax, 0xffffffff
jmp 0x40e993
mov eax, dword [ebp - 4]
jmp 0x40e993
push 0
push edi
push 1
push 0
push 1
push esi
mov ecx, ebx
call fcn.00406087
push eax
call fcn.0040f3a5
mov esi, eax
or eax, 0xffffffff
cmp esi, eax
je 0x40e993
mov ecx, dword [ebp - 8]
call fcn.0040e850
test al, al
je 0x40e991
push 0
lea eax, [ebp - 4]
push eax
push 2
lea eax, [ebp - 8]
push eax
push esi
mov dword [ebp - 8], 0xfeff
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40eafc
Capabilities:
Write file on windows

Disassembly:
push 0x18
mov eax, 0x413f97
call fcn.004124d9
mov esi, ecx
xor ebx, ebx
cmp byte [esi], bl
je 0x40ec66
cmp byte [esi + 0x38], bl
jne 0x40eb1e
call fcn.0040e998
inc dword [esi + 0x38]
lea ecx, [ebp - 0x24]
call fcn.0040aeea
mov dword [ebp - 4], ebx
push ebx
push ebx
lea ecx, [esi + 0x24]
call fcn.00406087
push eax
lea ecx, [ebp - 0x24]
call fcn.0040b039
test eax, eax
jl 0x40ec5a
mov ecx, esi
call fcn.0040e8e5
cmp eax, 0xffffffff
mov dword [ebp - 0x10], eax
je 0x40ec5a
mov edi, dword [ebp + 8]
mov eax, edi
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, bx
jne 0x40eb62
sub eax, edx
sar eax, 1
xor ecx, ecx
push 2
lea eax, [eax + eax + 1]
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0040a97d
pop ecx
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], ebx
cmp eax, ebx
je 0x40eb9a
mov dword [ebp - 0x18], 1
mov byte [ebp - 4], 4
mov eax, dword [ebp - 0x1c]
xor edx, edx
cmp word [edi], bx
mov ecx, edi
je 0x40ebcf
cmp word [ecx], 0xa
jne 0x40ebbd
cmp dx, 0xd
je 0x40ebbd
mov word [eax], 0xd
inc eax
inc eax
mov dx, word [ecx]
mov word [eax], dx
movzx edx, word [ecx]
inc eax
inc eax
inc ecx
inc ecx
cmp word [ecx], bx
jne 0x40ebaa
mov ecx, esi
mov word [eax], bx
call fcn.0040e850
test al, al
je 0x40ec07
mov eax, dword [ebp - 0x1c]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, bx
jne 0x40ebe3
sub eax, edx
push ebx
sar eax, 1
lea ecx, [ebp + 8]
push ecx
add eax, eax
push eax
push dword [ebp - 0x1c]
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_WriteFile]
jmp 0x40ec46
push ebx
push 1
push ebx
push ebx
lea eax, [ebp + 8]
push eax
push dword [ebp - 0x1c]
call fcn.0040ef72
test eax, eax
jl 0x40ec4f
mov eax, dword [ebp + 8]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x40ec22
push ebx
lea ecx, [ebp - 0x14]
push ecx
sub eax, edx
push eax
push dword [ebp + 8]
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_WriteFile]
push dword [ebp + 8]
call fcn.0040a9fc
pop ecx
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x1c]
call fcn.0040fca5
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x24]
call fcn.0040af9c
call fcn.004125b1
ret 4

Function at 0x40eda2
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0x14]
push edi
mov edi, dword [ebp + 0x18]
push edi
push 0
push esi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, dword [esi]
cmp ecx, 1
je 0x40edd1
cmp ecx, 7
je 0x40edd1
cmp ecx, 2
jne 0x40ede6
test eax, eax
jne 0x40ede6
test edi, edi
je 0x40ede6
mov ecx, dword [edi]
test ecx, ecx
je 0x40ede6
lea eax, [ecx + ecx]
mov dword [edi], eax
xor eax, eax
pop edi
pop esi
pop ebp
ret 0x14
Function at 0x40f50a
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x41716c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x14], ebx
cmp dword [0x417150], ebx
je 0x40f54d
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
jmp 0x40f65e
push ebx
push 1
push ebx
push ebx
lea eax, [ebp - 0xc]
push eax
push dword [ebp + 0xc]
call fcn.0040ef72
test eax, eax
jl 0x40f652
cmp dword [ebp + 0x14], ebx
jne 0x40f571
lea eax, [ebp - 0x14]
mov dword [ebp + 0x14], eax
cmp dword [ebp + 0x18], ebx
jne 0x40f58f
push dword [ebp + 0x1c]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp - 0xc]
push dword [ebp + 8]
call fcn.0040eda2
jmp 0x40f64f
mov edi, dword [ebp + 0x1c]
mov esi, dword [edi]
push edi
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp - 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp eax, ebx
mov dword [ebp - 8], eax
je 0x40f5dc
mov eax, dword [ebp + 0x14]
mov eax, dword [eax]
cmp eax, 1
je 0x40f5c9
cmp eax, 7
je 0x40f5c9
cmp eax, 2
jne 0x40f652
cmp dword [ebp - 8], 0x7a
je 0x40f5d8
cmp dword [ebp - 8], 0xea
jne 0x40f652
shl dword [edi], 1
jmp 0x40f652
mov ecx, dword [edi]
cmp ecx, ebx
mov dword [ebp - 0x10], ecx
je 0x40f652
mov eax, dword [ebp + 0x14]
mov eax, dword [eax]
cmp eax, 1
je 0x40f5f9
cmp eax, 7
je 0x40f5f9
cmp eax, 2
jne 0x40f652
push ebx
push ebx
push ecx
push dword [ebp + 0x18]
push ebx
push ebx
call fcn.0040edec
cmp eax, ebx
je 0x40f649
add eax, eax
cmp esi, eax
mov dword [edi], eax
jae 0x40f61b
mov dword [ebp - 8], 0x7a
jmp 0x40f652
mov eax, dword [ebp - 0x10]
call fcn.00412850
mov edi, esp
push dword [ebp - 0x10]
push dword [ebp + 0x18]
push edi
call sub.MSVCR80.dll_memcpy
add esp, 0xc
shr esi, 1
push esi
push dword [ebp + 0x18]
push dword [ebp - 0x10]
push edi
push ebx
push ebx
call fcn.0040edec
test eax, eax
jne 0x40f652
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 8], eax
push dword [ebp - 0xc]
call fcn.0040a9fc
mov eax, dword [ebp - 8]
pop ecx
lea esp, [ebp - 0x20]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004124ca
leave
ret 0x18

Function at 0x40f9c2
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
xor eax, eax
cmp dword [0x417150], eax
je 0x40f9d6
pop ebp
jmp dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push esi
push eax
push 1
push eax
push eax
lea eax, [ebp + 8]
push eax
push dword [ebp + 8]
call fcn.0040ef72
test eax, eax
jl 0x40f9f9
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov esi, eax
jmp 0x40f9fc
or esi, 0xffffffff
push dword [ebp + 8]
call fcn.0040a9fc
pop ecx
mov eax, esi
pop esi
pop ebp
ret 4
Function at 0x40fa5c
Capabilities:
Get common file path

Disassembly:
push 0x214
mov eax, 0x413ff0
call fcn.004124d9
xor edi, edi
cmp dword [0x417150], edi
je 0x40fa86
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
jmp 0x40fb31
mov dword [ebp - 0x220], edi
mov dword [ebp - 0x21c], edi
mov dword [ebp - 0x218], 0x200
mov dword [ebp - 4], edi
mov ebx, dword [ebp + 8]
add ebx, ebx
push ebx
lea ecx, [ebp - 0x220]
call fcn.0040f0b0
cmp eax, edi
mov dword [ebp - 0x10], eax
jne 0x40fad9
or dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x220], edi
je 0x40fad5
push dword [ebp - 0x220]
call fcn.0040a9fc
pop ecx
mov dword [ebp - 0x220], edi
xor eax, eax
jmp 0x40fb31
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov esi, eax
cmp esi, edi
je 0x40fb02
cmp esi, ebx
jae 0x40fb02
push dword [ebp + 8]
push dword [ebp + 0xc]
push 0xffffffffffffffff
push dword [ebp - 0x10]
push edi
push edi
call fcn.0040edec
mov esi, eax
dec esi
jmp 0x40fb11
mov eax, dword [ebp + 0xc]
cmp eax, edi
je 0x40fb11
cmp dword [ebp + 8], edi
je 0x40fb11
mov word [eax], di
or dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x220], edi
je 0x40fb2f
push dword [ebp - 0x220]
call fcn.0040a9fc
pop ecx
mov dword [ebp - 0x220], edi
mov eax, esi
call fcn.004125b1
ret 8

Function at 0x40fb39
Capabilities:
Query environment variable

Disassembly:
push 0x218
mov eax, 0x414019
call fcn.004124d9
xor esi, esi
cmp dword [0x417150], esi
je 0x40fb66
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
jmp 0x40fc3b
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x224], esi
mov dword [ebp - 0x220], esi
mov dword [ebp - 0x21c], 0x200
mov dword [ebp - 4], esi
mov ebx, dword [ebp + 0x10]
add ebx, ebx
push ebx
lea ecx, [ebp - 0x224]
call fcn.0040f0b0
cmp eax, esi
mov dword [ebp - 0x14], eax
jne 0x40fbbc
or dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x224], esi
je 0x40fbb8
push dword [ebp - 0x224]
call fcn.0040a9fc
pop ecx
mov dword [ebp - 0x224], esi
xor eax, eax
jmp 0x40fc3b
push esi
push 1
push esi
push esi
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 8]
call fcn.0040ef72
test eax, eax
jge 0x40fbd5
xor edi, edi
jmp 0x40fc12
push ebx
push dword [ebp - 0x14]
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
cmp dword [ebp + 0x10], esi
mov edi, eax
je 0x40fc12
cmp edi, ebx
ja 0x40fc12
cmp edi, esi
je 0x40fc08
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push 0xffffffffffffffff
push dword [ebp - 0x14]
push esi
push esi
call fcn.0040edec
mov edi, eax
dec edi
jmp 0x40fc12
mov eax, dword [ebp + 0xc]
cmp eax, esi
je 0x40fc12
mov word [eax], si
push dword [ebp - 0x10]
call fcn.0040a9fc
pop ecx
or dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x224], esi
je 0x40fc39
push dword [ebp - 0x224]
call fcn.0040a9fc
pop ecx
mov dword [ebp - 0x224], esi
mov eax, edi
call fcn.004125b1
ret 0xc
Function at 0x410214
Capabilities:
Hash data using djb2

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov esi, dword [ebp + 8]
mov edi, 0x1505
jmp 0x410235
push eax
call dword [sym.imp.MSVCR80.dll_towupper]
imul edi, edi, 0x21
movzx eax, ax
xor edi, eax
inc esi
pop ecx
inc esi
movzx eax, word [esi]
test ax, ax
jne 0x410223
mov eax, edi
pop edi
pop esi
pop ebp
ret 4

Function at 0x410245
Capabilities:
Hash data using djb2

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov esi, dword [ebp + 8]
mov edi, 0x1505
jmp 0x410270
mov ecx, dword [ebp + 0xc]
dec dword [ebp + 0xc]
test ecx, ecx
je 0x410278
push eax
call dword [sym.imp.MSVCR80.dll_towupper]
imul edi, edi, 0x21
movzx eax, ax
xor edi, eax
inc esi
pop ecx
inc esi
movzx eax, word [esi]
test ax, ax
jne 0x410254
mov eax, edi
pop edi
pop esi
pop ebp
ret 8

Function at 0x4124ca
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x41716c]
jne 0x4124d4
repz ret
jmp fcn.00412b25
Function at 0x57fe0c
Capabilities:
Encode data using xor

Disassembly:
mov dword [esp], 0xc2620a28
mov esp, ebp
movsx ebp, bl
bswap bp
call fcn.00509592
add bh, byte [esi]
push edi
salc
pushal
mov ebx, 0x40be682b
sbb al, byte [edi]
in eax, 0x13
test al, 0xf6
fld st(1)
mov dl, byte [edi]
aas
sub byte [ebp + 3], dh
sahf
invalid

Function at 0x59a5af
Capabilities:
Encode data using xor

Disassembly:
mov ebx, dword [esp + 8]
movzx cx, dl
not ecx
pop ecx
push dword [esp]
mov ecx, dword [esp + 0xc]
pushfd
mov esp, ebp
pushal
call fcn.00500379
xor edi, dword [ebx]
or al, 0x8b
pop es
mov ebp, 0x3cae762b
adc ch, byte gs:[esi + ecx*4 - 0xe9cc90]
dec esp
cdq
lahf
or dl, ch
push es
mov dh, 0x90
mov esi, 0xb90b2dc5
test eax, 0x8bab1546
mov ebp, 0xbd352025
lahf
lodsd eax, dword [esi]
fadd dword [ecx]
or al, al
dec esp
jecxz 0x59a5b3
xor byte [edx - 0x287cb93f], al
pushal
cld
push eax
inc ebx
pop edi
std
cmp dl, byte [ebp - 0x10b41216]
or edi, eax
out 0x81, eax
out 0x24, al
insb byte es:[edi], dx
cdq
sub al, 0x34
nop
add byte [esi], ch
xchg esp, eax
shr byte [0x34474e01], 1
scasd eax, dword es:[edi]
test al, 0x7f
loopne 0x59a68f
out 0xff, eax
idiv cl
sub al, 0x10
sub cl, ah
and al, 0xf2
invalid
xchg byte [eax + eax*8], dh
aas
or byte [ebp + 0x5a9ed12b], bh
mov bh, 0xc4
pop esp
and al, 0xb6
ret

Function at 0x59c41a
Capabilities:
Encode data using xor

Disassembly:
pushal
jmp 0x599321
jmp 0x59a4b9
test edx, edx
pushal
lea esp, [esp + 0x40]
je fcn.00583196
shrd cx, di, 9
add edx, eax
sbb cl, 0x7b
mov ecx, dword [esi + 0x7c]
cmp ah, al
push eax
push eax
jmp 0x599781
add ecx, edx
mov byte [esp], bh
mov dword [ebp - 0x10], ecx
rcr ch, 7
mov ecx, dword [ebp + 0xc]
pushfd
stc
cmc
pushfd
cmp ecx, 0xffff
mov byte [esp + 0xc], 0x89
mov byte [esp], bl
lea esp, [esp + 0x10]
je fcn.00583196
sub dh, 0x49
mov esi, dword [eax + 0x3c]
push ebx
pop edx
setl dh
rcr dl, cl
add esi, eax
sal dh, 3
rcr dx, cl
movsx edx, dl
inc dx
mov edx, dword [esi + 0x78]
jmp 0x508092
jmp 0x5a0953
call fcn.0059ad32
retf 0x83d3
push 0xb2a49453
add dl, dl
push 0x11bb8271
pushfd
push dword [esp + 8]
lea esp, [esp + 0x10]
jne 0x583ba0
not dl
call fcn.0058329d
pushal
lea esp, [esp + 0x20]
jne 0x5891c0
push 0xf968384a
lea esp, [esp + 4]
je fcn.00583196
movsx edx, dl
mov dh, 0xe9
lea edx, [ebp - 0x7d7d7aa9]
sbb dh, 0xae
mov esi, dword [eax + 0x3c]
seta dl
jmp 0x5bb844
bt ebp, 0xa
add esi, eax
bts edx, 7
neg dl
inc dl
mov edx, dword [esi + 0x78]
push edx
test edx, edx
pushfd
call fcn.0057c6a2
mov word [esp + 4], dx
lea esp, [esp + 8]
jne 0x500393
sub di, 0xab98
neg di
mov edi, dword [edx + 0x24]
pushfd
pushal
clc
add edi, eax
push dword [esp]
movzx ecx, word [edi + ecx*2]
sub esp, 0xffffffd8
jge 0x5bef57
mov edi, dword [edx + 0x1c]
jmp 0x59d15c
mov di, 0x293c
mov edi, dword [edx + 0x1c]
call fcn.0059cf96
pop edx
call 0xbfadc6e1
sub ebp, dword [ecx + 0x4b]
sbb byte [edx], bl
enter 0xffffffffffff9bb8, 4
mov word [esi + 0x53], fs
mov word [ecx], ds
mov edx, 0xad58fdd7
scasd eax, dword es:[edi]
imul esi, dword [ebx], 0xffffffc5
shl edi, cl
mov ah, 0x22
invalid
Function at 0x59cc7e
Capabilities:
Check for software breakpoints

Disassembly:
pushfd
push dword [esp + 4]
lea esp, [esp + 0x4c]
ja 0x5a0452
push ebx
jmp 0x589366
lea esp, [esp + 4]
jb 0x505da9
pushfd
mov byte [esp], 0xe7
call fcn.0059d413
jno 0x5893da
ret
dec eax
sbb ebx, edi
xchg esi, eax
sbb eax, 0x6179a83
cmp byte [ebp - 0x7a], ah
fisttp dword [edx - 0x19bc4a2d]
invalid
jmp 0x588cc2
dec al
cmc
xor al, 1
pushfd
bt cx, bp
jmp 0x5b9c3d
cmp dh, 0xcc
cmp al, byte [edi]
mov word [esp + 4], 0x5faf
lea edi, [edi + 1]
pop eax
mov eax, dword [esp + 0x40]
jmp 0x59baaa
stc
neg al
pushfd
dec al
test bh, 0x91
jmp 0x59d758
Function at 0x42e004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
mov eax, section..text
nop
nop
mov ebx, 0x407ef8
mov ecx, 0x768905ff
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x42e04e
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x42e024
nop
nop
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x42cd70
nop
mov ecx, 0x27e66dc8
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x42e084
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x42e06c
nop
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x401219
Function at 0x1001e5f9
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
mov eax, dword [ebp + 0x10]
mov dword [ebp - 8], eax
mov ecx, dword [ebp + 0x10]
mov dl, byte [ecx + 0x100]
mov byte [ebp - 0xc], dl
mov eax, dword [ebp + 0x10]
mov cl, byte [eax + 0x101]
mov byte [ebp - 0x14], cl
mov dword [ebp - 0x10], 0
jmp 0x1001e630
mov edx, dword [ebp - 0x10]
add edx, 1
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp + 0xc]
jge 0x1001e6c8
mov cl, byte [ebp - 0xc]
add cl, 1
mov byte [ebp - 0xc], cl
mov edx, dword [ebp - 0xc]
and edx, 0xff
mov eax, dword [ebp - 8]
mov cl, byte [eax + edx]
mov byte [ebp - 4], cl
mov dl, byte [ebp - 0x14]
add dl, byte [ebp - 4]
mov byte [ebp - 0x14], dl
mov eax, dword [ebp - 0x14]
and eax, 0xff
mov ecx, dword [ebp - 0xc]
and ecx, 0xff
mov edx, dword [ebp - 8]
mov esi, dword [ebp - 8]
mov al, byte [esi + eax]
mov byte [edx + ecx], al
mov ecx, dword [ebp - 0x14]
and ecx, 0xff
mov edx, dword [ebp - 8]
mov al, byte [ebp - 4]
mov byte [edx + ecx], al
mov ecx, dword [ebp - 0xc]
and ecx, 0xff
mov edx, dword [ebp - 8]
mov al, byte [ebp - 4]
add al, byte [edx + ecx]
mov byte [ebp - 4], al
mov ecx, dword [ebp - 4]
and ecx, 0xff
mov edx, dword [ebp + 8]
add edx, dword [ebp - 0x10]
mov eax, dword [ebp - 8]
mov dl, byte [edx]
xor dl, byte [eax + ecx]
mov eax, dword [ebp + 8]
add eax, dword [ebp - 0x10]
mov byte [eax], dl
jmp 0x1001e627
mov ecx, dword [ebp + 0x10]
mov dl, byte [ebp - 0xc]
mov byte [ecx + 0x100], dl
mov eax, dword [ebp + 0x10]
mov cl, byte [ebp - 0x14]
mov byte [eax + 0x101], cl
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x55fa80
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x109000]
push edi
jmp 0x55fa9a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x55faa1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x55fa90
mov eax, 1
add ebx, ebx
jne 0x55fab3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x55fac4
jne 0x55fae3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x55fae3
dec eax
add ebx, ebx
jne 0x55fad0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x55faa8
add ebx, ebx
jne 0x55fadf
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x55fb35
xor ecx, ecx
sub eax, 3
jb 0x55fafb
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x55fb6a
sar eax, 1
mov ebp, eax
jmp 0x55fb06
add ebx, ebx
jne 0x55fb06
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x55fad4
inc ecx
add ebx, ebx
jne 0x55fb14
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x55fad4
add ebx, ebx
jne 0x55fb21
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x55fb16
jne 0x55fb32
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x55fb16
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x55fb54
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x55fb46
jmp 0x55fa96
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x55fb54
add edi, ecx
jmp 0x55fa96
pop esi
mov edi, esi
mov ecx, 0x3ee5
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x55fb72
cmp byte [edi], 0x11
jne 0x55fb72
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x55fb77
lea edi, [esi + 0x158000]
mov eax, dword [edi]
or eax, eax
je 0x55fbef
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x1e5f6c]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x1e60e8]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x55fba4
mov ecx, edi
jns 0x55fbd3
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x1e60ec]
or eax, eax
je 0x55fbe9
mov dword [ebx], eax
add ebx, 4
jmp 0x55fbc1
call dword [esi + 0x1e60fc]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x55fc20
cmp al, 0xef
ja 0x55fc13
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x55fbf5
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x55fc02
mov ebp, dword [esi + 0x1e60f0]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x22f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x55fc54
sub esp, 0xffffff80
jmp 0x427f4a
Function at 0x2ce2f34
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x2ce2f3a
ret