joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5adda0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x61a516
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x6e7070]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [0x6e7ac8]
or ebx, 0xffffffff
mov edi, dword [ebp + 8]
mov dword [ebp - 4], 0
mov dword [ebp + 8], edi
cmp eax, ebx
je 0x5ade94
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x5ade94
lea esi, [eax + 0x14]
lea eax, [ebp + 8]
mov ecx, esi
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.005ad660
mov eax, dword [ebp - 0x10]
cmp eax, dword [esi]
je 0x5ade94
lea esi, [eax + 0x14]
test esi, esi
je 0x5ade94
cmp byte [ebp + 0x18], 0
je 0x5ade34
mov ecx, dword [esi]
test ecx, ecx
setne al
test al, al
je 0x5ade34
mov edx, dword [esi + 8]
test edx, edx
je 0x5ade34
mov eax, dword [ecx]
push edx
call dword [eax + 4]
mov ecx, dword [ebp + 0xc]
test ecx, ecx
setne al
test al, al
jne 0x5ade51
cmp dword [ebp + 0x14], 0
jne 0x5ade51
push edi
call fcn.005ad600
add esp, 4
jmp 0x5adec6
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x5ade5c
lock inc dword [eax + 4]
mov dword [esi], ecx
mov edi, dword [esi + 4]
mov dword [esi + 4], eax
mov byte [ebp - 4], 3
test edi, edi
je 0x5ade8c
mov eax, ebx
lock xadd dword [edi + 4], eax
jne 0x5ade8c
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 4]
mov eax, ebx
lock xadd dword [edi + 8], eax
jne 0x5ade8c
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 8]
mov eax, dword [ebp + 0x14]
mov dword [esi + 8], eax
jmp 0x5adec6
mov ecx, dword [ebp + 0xc]
test ecx, ecx
setne al
test al, al
mov eax, dword [ebp + 0x14]
jne 0x5adea7
test eax, eax
je 0x5adec6
push eax
sub esp, 8
mov eax, esp
mov dword [eax], ecx
mov ecx, dword [ebp + 0x10]
mov dword [eax + 4], ecx
test ecx, ecx
je 0x5adebd
lock inc dword [ecx + 4]
push edi
call fcn.005acc30
add esp, 0x10
mov esi, dword [ebp + 0x10]
mov dword [ebp - 4], 5
test esi, esi
je 0x5adef3
mov eax, ebx
lock xadd dword [esi + 4], eax
jne 0x5adef3
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
lock xadd dword [esi + 8], ebx
dec ebx
jne 0x5adef3
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x5b1f20
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
push edi
mov edi, dword [eax]
mov ecx, edi
lea edx, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x5b1f30
sub ecx, edx
mov esi, 0x811c9dc5
mov edx, 0
je 0x5b1f56
movzx eax, byte [edx + edi]
inc edx
xor eax, esi
imul esi, eax, 0x1000193
cmp edx, ecx
jb 0x5b1f45
push 0x1f31d
and esi, 0x7fffffff
push esi
call fcn.006090bb
imul ecx, eax, 0xb14
add esp, 8
imul edx, edx, 0x41a7
pop edi
pop esi
sub edx, ecx
lea eax, [edx + 0x7fffffff]
js 0x5b1f84
mov eax, edx
pop ebp
ret 4
Function at 0x5c6890
Capabilities:
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x61bc48
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x6e7070]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x14], 0xf
mov dword [esi + 0x10], 0
cmp dword [esi + 0x14], 0x10
jb 0x5c68df
mov eax, dword [esi]
jmp 0x5c68e1
mov eax, esi
push 0xffffffffffffffff
push 0
push dword [ebp + 8]
mov byte [eax], 0
call fcn.00406123
push 0xffffffffffffffff
lea ecx, [esi + 0x18]
mov dword [ebp - 4], 0
mov dword [ecx + 0x14], 0xf
push 0
push dword [ebp + 0xc]
mov dword [ecx + 0x10], 0
mov byte [ecx], 0
call fcn.00406123
mov eax, dword [ebp + 0x10]
mov dword [esi + 0x30], eax
mov eax, dword [ebp + 0x14]
mov dword [esi + 0x34], eax
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 0x10
Function at 0x5c69b0
Capabilities:
Encrypt data using chaskey
Hash data using murmur3

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x61bcf7
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push esi
push edi
mov eax, dword [0x6e7070]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x14], edi
mov dword [edi], 0
mov dword [edi + 4], 0
mov dword [edi + 8], 0
lea ecx, [edi + 0xc]
mov dword [ebp - 4], 0
mov dword [ebp - 0x18], ecx
call fcn.005c6440
lea ecx, [edi + 0x2c]
mov byte [ebp - 4], 1
mov dword [ebp - 0x18], ecx
call fcn.005c6440
lea eax, [ebp - 0xd]
mov byte [ebp - 4], 2
push eax
lea ecx, [edi + 0x4c]
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x18], ecx
push eax
mov byte [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0
call fcn.005c60e0
mov dword [edi + 0x70], 0
mov dword [edi + 0x74], 0
mov dword [edi + 0x78], 0
mov dword [edi + 0x7c], 0
mov dword [edi + 0x80], 0
mov dword [edi + 0x84], 0
mov dword [edi + 0x88], 0
mov dword [edi + 0x8c], 0
mov dword [edi + 0x90], 0
mov dword [edi + 0x94], 0
mov dword [edi + 0x98], 0
mov dword [edi + 0x9c], 0
xor al, al
mov byte [ebp - 4], 7
lea esi, [edi + 0xa0]
mov dword [ebp - 0x18], esi
mov ecx, esi
mov byte [ebp - 0x24], al
lea eax, [ebp - 0xd]
push eax
lea eax, [ebp - 0x24]
mov dword [ebp - 0x20], 0
push eax
call fcn.005c6040
push 3
mov ecx, esi
mov byte [ebp - 4], 8
call fcn.005d93d0
xor al, al
mov byte [ebp - 4], 9
lea esi, [edi + 0xc4]
mov dword [ebp - 0x18], esi
mov ecx, esi
mov byte [ebp - 0x24], al
lea eax, [ebp - 0xd]
push eax
lea eax, [ebp - 0x24]
mov dword [ebp - 0x20], 0
push eax
call fcn.005c5fa0
push 3
mov ecx, esi
mov byte [ebp - 4], 0xa
call fcn.005d93d0
lea esi, [edi + 0xe8]
mov byte [ebp - 4], 0xb
mov dword [ebp - 0x18], esi
mov dword [esi], 0
mov ecx, esi
mov dword [esi + 4], 0
call fcn.005d6940
mov dword [esi], eax
mov eax, edi
mov dword [edi + 0xf0], 0
mov dword [edi + 0xf4], 0
mov dword [edi + 0xf8], 0
mov dword [edi + 0xfc], 0
mov dword [edi + 0x100], 0
mov dword [edi + 0x104], 0
mov dword [edi + 0x108], 0
mov dword [edi + 0x10c], 0
mov dword [edi + 0x110], 0
mov dword [edi + 0x114], 0
mov dword [edi + 0x118], 0
mov dword [edi + 0x11c], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
add ecx, 0x1b739bc7
and ebx, ebx
add eax, 0x39051eda
ficomp dword [esi]
add eax, 0x81d60b39
loope 0x5c6c24
inc ecx
xor ecx, dword [ecx + 0xae9c146]
Function at 0x5c6f30
Capabilities:
Hash data using murmur3

Disassembly:
ror edi, 4
sub edi, 0x6c9a15db
xor edx, edi
and dword [0x764a6c], edi
dec edx
add ecx, 0xa029ce75
xor dword [0x7648da], edi
dec ecx
neg esi
inc edi
sub dword [0x764c2a], ebx
add ebx, edi
add dword [0x764aaf], 0xb7e4b386
inc ebx
neg esi
or dword [0x764adc], edx
sub ebx, edx
xor dword [0x764aad], ecx
sub edx, 0x2f3bd8a8
not esi
xor edx, dword [0x764c76]
call fcn.00585717
xchg esi, edx
ror edi, 0x1c
not esi
or edi, dword [0x764cfa]
ror edx, 0x10
add esi, dword [0x764fbe]
rol edx, 0x10
not esi
rol edi, 0x1c
xchg esi, edx
not esi
add edx, 0x2f3bd8a8
add ebx, edx
xor dword [0x764be1], ecx
neg esi
dec ebx
xor dword [0x76498e], 0x5873274b
sub ebx, edi
and dword [0x764b68], eax
dec edi
neg esi
inc ecx
push ecx
sub ebx, dword [0x764dd5]
not esi
add esi, edi
call fcn.0053acba
ror esi, 0xd
add dword [0x764bb7], edx
xchg ebx, eax
inc ebx
sub dword [0x764adf], 0x37ec69d8
not eax
call fcn.0042cf3f
xor dword [0x7648ea], eax
not ecx
add esi, dword [0x764ce0]
call fcn.0056b83b
call fcn.0052822e
not ecx
xor dword [0x764b04], edx
not eax
dec ebx
xchg ebx, eax
mov dword [0x764a9f], edi
rol esi, 0xd
call fcn.0049866d
sub esi, edi
not esi
mov esi, 0xacbde151
ror edx, 4
mov dword [0x76493c], eax
add ebx, dword [0x764d10]
not esi
ror esi, 0x18
dec eax
sub edi, dword [0x764d9f]
ror ecx, 0x1c
xchg eax, esi
sub ecx, dword [0x764f09]

Function at 0x5c7060
Capabilities:
Hash data using murmur3

Disassembly:
neg esi
add dword [0x76497e], 0x197bcbe8
sub ecx, 0x681b654c
add dword [0x764a13], edi
and dword [0x764ad6], esi
sub dword [0x764a25], ecx
or dword [0x764a29], eax
add ecx, 0x681b654c
mov dword [0x764bdf], 0x80cf5ffc
neg esi
xchg eax, esi
rol ecx, 0x1c
inc eax
rol esi, 0x18
not esi
mov dword [0x764b55], edi
rol edx, 4
xor esi, 0x35f23208
neg ecx
xor dword [0x764989], eax
sub ebx, dword [0x764ce2]
rol esi, 0xd
xchg ecx, edx
ror edi, 7
dec edx
add ebx, dword [0x764d48]
xchg eax, esi
xor esi, ecx
sub edx, dword [0x764eab]
xor esi, ecx
xchg eax, esi
inc edx
rol edi, 7
xchg ecx, edx
ror esi, 0xd
add dword [0x764a01], edx

Function at 0x5c70f0
Capabilities:
Hash data using murmur3

Disassembly:
neg ecx
xor esi, 0xf73db632
xor ebx, 0xc6cd7ba2
or edi, dword [0x764e5f]
ror ebx, 0x14
inc eax
not esi
call fcn.005e3b79
or edi, dword [0x764eaa]
add dword [0x764b2a], ecx
xchg ecx, edx
xor ebx, dword [0x764c64]
sub eax, dword [0x764d10]
xor esi, dword [0x764c75]
inc esi
dec edi
xor edi, ecx
neg esi
add dword [0x764b3f], eax
sub esi, dword [0x764cac]
call fcn.0055c9f3
call fcn.004941c4
neg esi
xor edi, ecx
inc edi
dec esi
xchg ecx, edx
add dword [0x764a14], edx
call fcn.005b99cd
not esi
dec eax
rol ebx, 0x14
xor ebx, 0xc6cd7ba2
push esi
xor dword [0x764a55], 0x901d6aec
ror esi, 0x10
xor edi, dword [0x764f52]
add ebx, dword [0x764ed9]
xchg ebx, edx
xor ebx, 0x6ea2f341
neg esi
mov dword [0x764a5f], ebx
and dword [0x764ba7], ebx
call fcn.0049911c
or ecx, dword [0x764e8b]
ror ebx, 6
rol ebx, 6
mov dword [0x764c0e], ebx
add dword [0x764b7b], eax
neg esi
xor ebx, 0x6ea2f341
invalid
Function at 0x5d7fd0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, ecx
push esi
mov esi, dword [ebp + 0xc]
mov dword [ebp - 4], ebx
mov edx, dword [ebx + 8]
cmp esi, dword [edx]
jne 0x5d8003
cmp eax, edx
jne 0x5d8003
call fcn.005d78c0
mov eax, dword [ebx + 8]
pop esi
pop ebx
mov ecx, dword [eax]
mov eax, dword [ebp + 8]
mov dword [eax], ecx
mov esp, ebp
pop ebp
ret 0xc
cmp esi, eax
je 0x5d80d9
push edi
nop dword [eax]
mov eax, dword [esi]
mov dword [ebp + 0xc], eax
mov eax, dword [esi + 8]
lea edx, [eax + 1]
nop dword [eax + eax]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x5d8020
sub eax, edx
mov edi, 0x811c9dc5
mov edx, 0
je 0x5d804c
mov ebx, dword [esi + 8]
movzx ecx, byte [edx + ebx]
inc edx
xor ecx, edi
imul edi, ecx, 0x1000193
cmp edx, eax
jb 0x5d8038
mov ebx, dword [ebp - 4]
push 0x1f31d
and edi, 0x7fffffff
push edi
call fcn.006090bb
imul ecx, edx, 0x41a7
add esp, 8
imul eax, eax, 0xb14
sub ecx, eax
jns 0x5d8076
add ecx, 0x7fffffff
mov eax, dword [ebx + 0x1c]
and eax, ecx
mov ecx, dword [ebx + 0x10]
lea edx, [eax*8]
add ecx, edx
cmp dword [ecx + 4], esi
jne 0x5d80a9
cmp dword [ecx], esi
jne 0x5d80a1
mov eax, dword [ebx + 8]
mov dword [ecx], eax
mov ecx, dword [ebx + 0x10]
mov eax, dword [ebx + 8]
mov dword [ecx + edx + 4], eax
jmp 0x5d80b1
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
jmp 0x5d80b1
cmp dword [ecx], esi
jne 0x5d80b1
mov eax, dword [esi]
mov dword [ecx], eax
mov ecx, dword [esi + 4]
mov eax, dword [esi]
push esi
mov dword [ecx], eax
mov ecx, dword [esi]
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
dec dword [ebx + 0xc]
call fcn.0052bdeb
mov esi, dword [ebp + 0xc]
add esp, 4
cmp esi, dword [ebp + 0x10]
jne 0x5d8010
pop edi
mov eax, dword [ebp + 8]
mov dword [eax], esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x5db3a0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x61d7f5
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x6e7070]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
lea ecx, [esi + 4]
mov dword [ebp - 4], 0
mov dword [esi], vtable.google::protobuf::DescriptorProto.0
call fcn.005c1270
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], 0
mov dword [esi + 0x54], 0
mov dword [esi + 0x58], 0
mov dword [esi + 0x5c], 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 0
mov dword [esi + 0x68], 0
mov dword [esi + 0x6c], 0
mov dword [esi + 0x70], 0
mov byte [ebp - 4], 7
call fcn.004ea2f1
mov dword [esi + 0xc], 0
mov eax, dword [0x71320c]
test eax, eax
jne 0x5db4b8
push 0x50
push str.c:jenkins_slaveworkspaceproto_pub_contrib_2_vendor_srcgoogleprotobufgenerated_message_util.h
push 0x6ac548
call fcn.0054db53
mov eax, dword [0x71320c]
add esp, 0xc
mov dword [esi + 0x10], eax
mov eax, esi
mov dword [esi + 0x74], 0
mov dword [esi + 8], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x5e5b80
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x61df98
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x6e7070]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x40
call fcn.0052bdf0
mov esi, eax
add esp, 4
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0
test esi, esi
je 0x5e5c15
lea ecx, [esi + 4]
mov byte [ebp - 4], 1
mov dword [esi], vtable.google::protobuf::FileOptions.0
call fcn.005ec3e0
lea ecx, [esi + 0xc]
mov byte [ebp - 4], 2
call fcn.005c1270
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov ecx, esi
mov byte [ebp - 4], 4
call fcn.005e8c60
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x430006
Capabilities:
Encode data using xor

Disassembly:
mov eax, section..text
nop
mov ebx, 0x408f6c
nop
nop
mov ecx, 0x3cdf567c
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x43004e
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x430024
nop
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x42e3d0
nop
nop
mov ecx, 0x3c994a91
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x430084
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x43006c
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x401219
Function at 0x10004cd0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, edx
test esi, esi
not eax
je 0x10004d02
lea esp, [esp]
test cl, 3
je 0x10004d02
movzx edx, byte [ecx]
xor edx, eax
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x1784a460]
add ecx, 1
sub esi, 1
jne 0x10004ce0
cmp esi, 0x20
push ebx
push edi
jb 0x10004eec
mov edi, esi
shr edi, 5
xor eax, dword [ecx]
add ecx, 4
mov edx, eax
shr edx, 0x10
movzx ebx, ah
and edx, 0xff
mov edx, dword [edx*4 + 0x1784a860]
xor edx, dword [ebx*4 + 0x1784ac60]
mov ebx, eax
and eax, 0xff
shr ebx, 0x18
xor edx, dword [ebx*4 + 0x1784a460]
add ecx, 4
xor edx, dword [eax*4 + 0x1784b060]
add ecx, 4
xor edx, dword [ecx - 8]
add ecx, 4
mov eax, edx
shr eax, 0x10
and eax, 0xff
mov eax, dword [eax*4 + 0x1784a860]
movzx ebx, dh
xor eax, dword [ebx*4 + 0x1784ac60]
mov ebx, edx
and edx, 0xff
shr ebx, 0x18
xor eax, dword [ebx*4 + 0x1784a460]
add ecx, 4
xor eax, dword [edx*4 + 0x1784b060]
add ecx, 4
xor eax, dword [ecx - 0x10]
mov edx, eax
shr edx, 0x10
movzx ebx, ah
and edx, 0xff
mov edx, dword [edx*4 + 0x1784a860]
xor edx, dword [ebx*4 + 0x1784ac60]
mov ebx, eax
and eax, 0xff
shr ebx, 0x18
xor edx, dword [ebx*4 + 0x1784a460]
xor edx, dword [eax*4 + 0x1784b060]
xor edx, dword [ecx - 0xc]
mov eax, edx
shr eax, 0x10
and eax, 0xff
mov eax, dword [eax*4 + 0x1784a860]
movzx ebx, dh
xor eax, dword [ebx*4 + 0x1784ac60]
mov ebx, edx
and edx, 0xff
shr ebx, 0x18
xor eax, dword [ebx*4 + 0x1784a460]
xor eax, dword [edx*4 + 0x1784b060]
xor eax, dword [ecx - 8]
mov edx, eax
shr edx, 0x10
movzx ebx, ah
and edx, 0xff
mov edx, dword [edx*4 + 0x1784a860]
xor edx, dword [ebx*4 + 0x1784ac60]
mov ebx, eax
and eax, 0xff
shr ebx, 0x18
xor edx, dword [ebx*4 + 0x1784a460]
xor edx, dword [eax*4 + 0x1784b060]
xor edx, dword [ecx - 4]
mov eax, edx
shr eax, 0x10
and eax, 0xff
mov eax, dword [eax*4 + 0x1784a860]
movzx ebx, dh
xor eax, dword [ebx*4 + 0x1784ac60]
mov ebx, edx
shr ebx, 0x18
xor eax, dword [ebx*4 + 0x1784a460]
and edx, 0xff
xor eax, dword [edx*4 + 0x1784b060]
xor eax, dword [ecx]
add ecx, 4
mov edx, eax
shr edx, 0x10
movzx ebx, ah
and edx, 0xff
mov edx, dword [edx*4 + 0x1784a860]
xor edx, dword [ebx*4 + 0x1784ac60]
mov ebx, eax
and eax, 0xff
shr ebx, 0x18
xor edx, dword [ebx*4 + 0x1784a460]
add ecx, 4
xor edx, dword [eax*4 + 0x1784b060]
sub esi, 0x20
xor edx, dword [ecx - 4]
mov eax, edx
shr eax, 0x10
and eax, 0xff
mov eax, dword [eax*4 + 0x1784a860]
movzx ebx, dh
xor eax, dword [ebx*4 + 0x1784ac60]
mov ebx, edx
shr ebx, 0x18
xor eax, dword [ebx*4 + 0x1784a460]
and edx, 0xff
xor eax, dword [edx*4 + 0x1784b060]
sub edi, 1
jne 0x10004d12
cmp esi, 4
jb 0x10004f39
mov edx, esi
shr edx, 2
xor eax, dword [ecx]
add ecx, 4
mov edi, eax
shr edi, 0x10
and edi, 0xff
mov edi, dword [edi*4 + 0x1784a860]
movzx ebx, ah
xor edi, dword [ebx*4 + 0x1784ac60]
mov ebx, eax
shr ebx, 0x18
xor edi, dword [ebx*4 + 0x1784a460]
and eax, 0xff
xor edi, dword [eax*4 + 0x1784b060]
sub esi, 4
sub edx, 1
mov eax, edi
jne 0x10004ef6
test esi, esi
pop edi
pop ebx
je 0x10004f5d
nop
movzx edx, byte [ecx]
xor edx, eax
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x1784a460]
add ecx, 1
sub esi, 1
jne 0x10004f40
not eax
pop esi
ret
Function at 0x40c006
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ecx, 0xcbf
mov ebx, edx
xor word [eax], dx
lea edx, [ebx + edx]
xchg dh, dl
lea eax, [eax + 2]
loop 0x40c00e
pop ebx
ret

Function at 0x4515f0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x3b000]
push edi
or ebp, 0xffffffff
jmp 0x451612
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x451619
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x451608
mov eax, 1
add ebx, ebx
jne 0x45162b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x451620
jne 0x45163c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x451620
xor ecx, ecx
sub eax, 3
jb 0x451650
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x4516c2
mov ebp, eax
add ebx, ebx
jne 0x45165b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x451668
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x45168c
inc ecx
add ebx, ebx
jne 0x451678
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x45166d
jne 0x451689
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x45166d
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x4516ac
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x45169d
jmp 0x45160e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x4516ac
add edi, ecx
jmp 0x45160e
pop esi
mov edi, esi
mov ecx, 6
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x4516ca
cmp byte [edi], 0x32
jne 0x4516ca
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x4516cf
lea edi, [esi + 0x4f000]
mov eax, dword [edi]
or eax, eax
je 0x451747
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x51a80]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x51abc]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x4516fc
mov ecx, edi
jns 0x45172b
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x51ac0]
or eax, eax
je 0x451741
mov dword [ebx], eax
add ebx, 4
jmp 0x451719
call dword [esi + 0x51ad0]
mov ebp, dword [esi + 0x51ac4]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1cf]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x45177b
sub esp, 0xffffff80
jmp 0x401094
Function at 0x41875f
Capabilities:
Encode data using xor

Disassembly:
dec esp
les edi, [ecx - 0x10]
inc eax
in eax, 0xc8
mov edx, 0xdd35ce4a
sub ebx, dword [eax - 0x2e]
mov ebx, 0xfef3251a
and al, 0x3c
sub ch, byte [ebp - 0x62a8e976]
lodsd eax, dword [esi]
mov dl, byte [esi]
push edi
popfd
dec ebp
dec esi
and eax, 0xf1b8e8b6
dec ecx
lodsb al, byte [esi]
cwde
mov al, 0x2f
mov dh, 0xdb
xchg dword [esi + esi], edi
pushal
lea ecx, [edi]
xchg esp, eax
mov dword [0x6ea00433], eax
xchg byte [edx], dl
fild dword [esi]
push ebp
xchg edx, eax
mov byte [0x7d3596e1], al
mov esi, esi
mov dh, 0x92
test byte [ecx - 0x7d], bl
nop
xor dword [ecx], ebx
jnp 0x418776
mov cl, 0xab
pop ds
int3

Function at 0x419776
Capabilities:
Encode data using xor

Disassembly:
invalid
dec edi
fucomp st(1)
aas
mov dl, bh
rcl byte [esi - 0x2d79b51f]
fcom dword [esi + ebp*4 - 0x6054cab8]
jbe 0x41973c
xchg esi, eax
fidivr word [eax]
or edi, esi
pop ds
xor byte [esi - 0x3d], 0x86
inc edx
insd dword es:[edi], dx
cmp edi, dword [ecx + 0x40]
mov edx, 0xcef7a881
xor eax, 0xba9f97d
or cl, dl
cmp dword [ebx], eax
pop ebx
outsd dx, dword [esi]
xchg ecx, eax
in al, 0xc7
pop ecx
mov dword [0x31520553], eax
not byte [ebp + esi + 0x16]
xor ecx, dword [eax + 0x16f299cc]
push edx
cmp eax, 0x69814da0
xchg ah, cl
push ebp
push ebp
sar dword [ebx], 0x2b
push edi
shl dword [eax + 0x4c], cl
mov esi, 0x84e2b7fc
insd dword es:[edi], dx
ja 0x419777
fstp dword [esi - 0x48]
insb byte es:[edi], dx
std
imul ecx, dword [ecx + eax - 0x3d3bd609], 0x84a8e8c1
push eax
jge 0x41983d
invalid
sub dl, byte [edi + esi*4 - 0x3d]
aas
outsb dx, byte [esi]
iretd
not ecx
je 0x419801
rcr byte [ebp + 0x6b], 1
inc eax
cmp byte [edi - 0x7d5e45b1], dh
invalid
xor byte ss:[ebx + eax + 0x7c18c2c7], bl
add byte [edx + 0x29], dl
xor al, 0x86
loope 0x419808
mov eax, dword [0xd22cbb51]
sub al, 0x2f
xor dword [ebp + ecx*2 + 0x48b4efc2], esi
int3
Function at 0x4052e3
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push esi
or esi, 0x4d66
or esi, 0x1669d
pop esi
push ebx
push esi
add esp, 4
call fcn.004052e3
add byte [ebp + 0x4e], al
dec ecx
cmp al, 0x3d
dec eax
add esp, 4
and ebx, 0xd9d3
jmp 0x4052f5
pop ebx
mov eax, dword [ebp - 0xc18]
mov cx, word [eax]
mov word [ebp - 0xf7e], cx
mov edx, dword [ebp - 0xc18]
add edx, 2
mov dword [ebp - 0xc18], edx
mov ax, word [ebp - 0xf7e]
mov word [ebp - 0x1f8], ax
mov ecx, dword [ebp - 0xc1c]
mov dx, word [ecx]
mov word [ebp - 0xf80], dx
mov eax, dword [ebp - 0xc1c]
add eax, 2
mov dword [ebp - 0xc1c], eax
mov cx, word [ebp - 0xf80]
mov word [ebp - 0x100], cx
push ebx
push eax
add esp, 4
jmp 0x40535c
and ebx, 0x20e5
sub ebx, 0xeec4
pop ebx
push ecx
push edi
add esp, 4
call 0x40537e
add byte [0x413f3a35], dh
dec edx
xor al, 0x35
inc esi
dec edx
add esp, 4
pop ecx
movzx edx, word [ebp - 0x100]
test edx, edx
jne 0x4053a5
movzx eax, word [ebp - 0x1f8]
movzx ecx, word [ebp - 0x100]
sub eax, ecx
mov dword [ebp - 0x1498], eax
jmp 0x405408
movzx edx, word [ebp - 0x1f8]
movzx eax, word [ebp - 0x100]
cmp edx, eax
je 0x4052c4
movzx ecx, word [ebp - 0x1f8]
xor ecx, 0x20
movzx edx, word [ebp - 0x100]
cmp ecx, edx
je 0x4052c4
movzx eax, word [ebp - 0x1f8]
movzx ecx, word [ebp - 0x100]
cmp eax, ecx
jge 0x4053f2
mov dword [ebp - 0x14d8], 0xffffffff
jmp 0x4053fc
mov dword [ebp - 0x14d8], 1
mov edx, dword [ebp - 0x14d8]
mov dword [ebp - 0x1498], edx
cmp dword [ebp - 0x1498], 0
jne 0x405451
push ebx
jmp 0x40541b
call 0x405428
add byte [edx + 0x3c], al
xor eax, 0x473f4745
add esp, 4
pop ebx
push edi
xor edi, 0x10064
add edi, 0x8130
jmp 0x405442
pop edi
mov eax, dword [ebp - 0x4d4]
mov dword [ebp - 0x2e0], eax
jmp 0x4054b9
push ebx
call 0x405460
add byte [eax + 0x38], al
dec edi
aas
cmp al, 0x48
cmp al, 0x83
les eax, [ecx + eax*4]
retf