joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45bcd0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x45bd6f
sub esp, 0x30
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
mov dword [esp + 8], ecx
mov dword [esp + 4], 0
lea edi, [esp + 0xc]
xor eax, eax
call fcn.00465577
lea ecx, [0x45bd80]
mov dword [esp + 0xc], ecx
lea ecx, [esp + 4]
mov dword [esp + 0x10], ecx
mov ecx, dword [esp + 0x30]
mov dword [esp + 0x14], ecx
lea ecx, [esp + 0x34]
mov dword [esp + 0x18], ecx
mov ecx, dword [esp + 8]
mov dword [esp + 0x1c], ecx
mov ecx, dword [esp + 0x34]
mov dword [esp + 0x20], ecx
mov ecx, dword [esp + 0x38]
mov dword [esp + 0x24], ecx
mov ecx, dword [esp + 0x3c]
mov dword [esp + 0x28], ecx
mov ecx, dword [esp + 0x40]
mov dword [esp + 0x2c], ecx
lea ecx, [esp + 0xc]
mov dword [esp], ecx
call fcn.00463f60
mov ecx, dword [esp + 4]
mov dword [esp + 0x44], ecx
add esp, 0x30
ret
call fcn.00464070
jmp fcn.0045bcd0
Function at 0x463040
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
sub esp, 0x20
mov dword [esp + 0x2c], 0
mov dword [esp + 0x30], 0
call fcn.004444f0
mov eax, dword fs:[0x14]
mov eax, dword [eax]
mov eax, dword [eax + 0x18]
mov dword [esp + 0xc], eax
test byte [eax], al
movzx ecx, byte [0x60b271]
test cl, cl
je 0x4630c9
call fcn.00434db0
mov eax, dword [esp]
mov ecx, dword [esp + 0xc]
mov dword [ecx + 0x190], eax
mov dword [ecx + 0x194], 3
mov eax, dword [esp + 0x24]
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0x800
lea edx, [esp + 0x14]
mov dword [esp], edx
call fcn.00451ae0
mov eax, dword [esp + 4]
mov ecx, dword [esp + 0xc]
mov dword [ecx + 0x198], eax
jmp 0x4630ff
call fcn.00434da0
mov eax, dword [esp]
mov ecx, dword [esp + 0xc]
mov dword [ecx + 0x190], eax
mov dword [ecx + 0x194], 1
lea eax, [esp + 0x28]
mov dword [esp], eax
call fcn.00451ae0
mov eax, dword [esp + 4]
mov ecx, dword [esp + 0xc]
mov dword [ecx + 0x198], eax
mov eax, dword [0x5e4eb4]
mov dword [esp], eax
lea eax, [ecx + 0x190]
mov dword [esp + 4], eax
call fcn.00404800
mov eax, dword [esp + 0x28]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0xc]
mov ecx, dword [eax + 0x19c]
mov dword [esp + 0x2c], ecx
test ecx, ecx
jne 0x46313b
mov eax, dword [eax + 0x1a4]
mov dword [esp + 0x30], eax
call fcn.00444580
add esp, 0x20
ret
Function at 0x465330
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movd xmm0, dword [esp + 8]
pinsrw xmm0, ebx, 4
pshufhw xmm0, xmm0, 0
movdqa xmm1, xmm0
pxor xmm0, xmmword [0x60b620]
aesenc xmm0, xmm0
cmp ebx, 0x10
jb 0x463afb
je 0x463b4e
cmp ebx, 0x20
jbe 0x463b54
cmp ebx, 0x40
jbe 0x463b9a
jmp 0x463c3b
test ebx, ebx
je 0x463b44
add eax, 0x10
test ax, 0xff0
je 0x463b30
movdqu xmm1, xmmword [eax - 0x10]
add ebx, ebx
pand xmm1, xmmword [ebx*8 + 0x518ce0]
pxor xmm1, xmm0
aesenc xmm1, xmm1
aesenc xmm1, xmm1
aesenc xmm1, xmm1
movd dword [edx], xmm1
ret
movdqu xmm1, xmmword [eax + ebx - 0x20]
add ebx, ebx
pshufb xmm1, xmmword [ebx*8 + 0x518de0]
jmp 0x463b18
aesenc xmm0, xmm0
movd dword [edx], xmm0
ret
movdqu xmm1, xmmword [eax]
jmp 0x463b18
pxor xmm1, xmmword [0x60b630]
aesenc xmm1, xmm1
movdqu xmm2, xmmword [eax]
movdqu xmm3, xmmword [eax + ebx - 0x10]
pxor xmm2, xmm0
pxor xmm3, xmm1
aesenc xmm2, xmm2
aesenc xmm3, xmm3
aesenc xmm2, xmm2
aesenc xmm3, xmm3
aesenc xmm2, xmm2
aesenc xmm3, xmm3
pxor xmm2, xmm3
movd dword [edx], xmm2
ret
movdqa xmm2, xmm1
movdqa xmm3, xmm1
pxor xmm1, xmmword [0x60b630]
pxor xmm2, xmmword [0x60b640]
pxor xmm3, xmmword [0x60b650]
aesenc xmm1, xmm1
aesenc xmm2, xmm2
aesenc xmm3, xmm3
movdqu xmm4, xmmword [eax]
movdqu xmm5, xmmword [eax + 0x10]
movdqu xmm6, xmmword [eax + ebx - 0x20]
movdqu xmm7, xmmword [eax + ebx - 0x10]
pxor xmm4, xmm0
pxor xmm5, xmm1
pxor xmm6, xmm2
pxor xmm7, xmm3
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
pxor xmm4, xmm6
pxor xmm5, xmm7
pxor xmm4, xmm5
movd dword [edx], xmm4
ret
movdqa xmm2, xmm1
movdqa xmm3, xmm1
pxor xmm1, xmmword [0x60b630]
pxor xmm2, xmmword [0x60b640]
pxor xmm3, xmmword [0x60b650]
aesenc xmm1, xmm1
aesenc xmm2, xmm2
aesenc xmm3, xmm3
movdqu xmm4, xmmword [eax + ebx - 0x40]
movdqu xmm5, xmmword [eax + ebx - 0x30]
movdqu xmm6, xmmword [eax + ebx - 0x20]
movdqu xmm7, xmmword [eax + ebx - 0x10]
aesenc xmm4, xmm0
aesenc xmm5, xmm1
aesenc xmm6, xmm2
aesenc xmm7, xmm3
dec ebx
shr ebx, 6
movdqu xmm0, xmmword [eax]
movdqu xmm1, xmmword [eax + 0x10]
movdqu xmm2, xmmword [eax + 0x20]
movdqu xmm3, xmmword [eax + 0x30]
aesenc xmm4, xmm0
aesenc xmm5, xmm1
aesenc xmm6, xmm2
aesenc xmm7, xmm3
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
add eax, 0x40
dec ebx
jne 0x463c9a
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
pxor xmm4, xmm6
pxor xmm5, xmm7
pxor xmm4, xmm5
movd dword [edx], xmm4
ret
cmp byte [0x60b26f], 0
je 0x46534a
mov eax, dword [esp + 4]
mov ebx, dword [esp + 0xc]
lea edx, [esp + 0x10]
jmp 0x463ac0
jmp fcn.00409070
Function at 0x465350
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4034ae
sub esp, 0x10
mov eax, dword [esp + 0x14]
mov ecx, dword [eax]
mov eax, dword [eax + 4]
mov dword [esp], ecx
mov ecx, dword [esp + 0x18]
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call fcn.00409070
mov eax, dword [esp + 0xc]
mov dword [esp + 0x1c], eax
add esp, 0x10
ret
call fcn.00464070
jmp 0x403470
cmp byte [0x60b26f], 0
je 0x46536b
mov eax, dword [esp + 4]
mov ebx, dword [eax + 4]
mov eax, dword [eax]
lea edx, [esp + 0xc]
jmp 0x463ac0
jmp 0x403470
Function at 0x47c5a0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x47c817
sub esp, 0x70
mov eax, dword [esp + 0x8c]
and eax, dword [esp + 0x78]
test eax, 0x80000000
je 0x47c6a3
mov eax, dword [esp + 0x7c]
mov ecx, dword [esp + 0x80]
mov edx, dword [esp + 0x90]
mov ebx, dword [esp + 0x94]
mov ebp, eax
sub eax, edx
mov esi, ecx
sbb ecx, ebx
test ecx, ecx
jge 0x47c63b
mov dword [esp + 0x34], ebx
mov dword [esp + 0x30], edx
cmp ebx, esi
xchg edi, ebx
setl bl
xchg edi, ebx
sete bl
cmp edx, ebp
setb dl
and edx, ebx
or edx, edi
test dl, dl
jne 0x47c621
test ecx, ecx
mov edx, dword [esp + 0x30]
mov ebx, dword [esp + 0x34]
jmp 0x47c63b
mov dword [esp + 0xa0], 0x7fffffff
mov dword [esp + 0x9c], 0xffffffff
add esp, 0x70
ret
mov dword [esp + 0x44], ecx
mov dword [esp + 0x3c], eax
xchg edi, ebx
setg bl
xchg edi, ebx
sete cl
test eax, eax
seta al
and eax, ecx
or eax, edi
test al, al
je 0x47c689
cmp ebx, esi
setg al
sete cl
cmp edx, ebp
seta dl
and edx, ecx
or edx, eax
test dl, dl
je 0x47c689
mov dword [esp + 0xa0], 0x80000000
mov dword [esp + 0x9c], 0
add esp, 0x70
ret
mov eax, dword [esp + 0x44]
mov dword [esp + 0xa0], eax
mov eax, dword [esp + 0x3c]
mov dword [esp + 0x9c], eax
add esp, 0x70
ret
lea eax, [esp + 0x74]
mov dword [esp], eax
call fcn.0047b070
mov eax, dword [esp + 4]
mov dword [esp + 0x58], eax
mov ecx, dword [esp + 8]
mov dword [esp + 0x54], ecx
lea edx, [esp + 0x88]
mov dword [esp], edx
call fcn.0047b070
mov eax, dword [esp + 4]
mov ecx, dword [esp + 0x58]
mov edx, ecx
sub ecx, eax
mov ebx, eax
mov eax, ecx
mov ebp, 0x3b9aca00
mov ecx, edx
mul ebp
mov dword [esp + 0x58], edx
mov dword [esp + 0x50], eax
mov ebp, dword [esp + 8]
sub ecx, ebx
mov ecx, dword [esp + 0x54]
sbb ecx, ebp
mov dword [esp + 0x4c], ecx
lea ebx, [esp + 0x74]
mov dword [esp], ebx
call fcn.0047b040
mov eax, dword [esp + 4]
mov dword [esp + 0x48], eax
lea ecx, [esp + 0x88]
mov dword [esp], ecx
call fcn.0047b040
mov eax, dword [esp + 0x4c]
imul eax, eax, 0x3b9aca00
mov ecx, dword [esp + 0x58]
add eax, ecx
mov ecx, dword [esp + 0x48]
sub ecx, dword [esp + 4]
mov edx, ecx
sar ecx, 0x1f
mov ebx, dword [esp + 0x50]
add ebx, edx
mov dword [esp + 0x38], ebx
adc eax, ecx
mov dword [esp + 0x40], eax
lea edi, [esp]
lea esi, [esp + 0x88]
call fcn.00465a5e
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], ebx
call fcn.0047c3d0
lea edi, [esp + 0x5c]
lea esi, [esp + 0x1c]
call fcn.00465a5e
lea edi, [esp]
lea esi, [esp + 0x5c]
call fcn.00465a5e
lea edi, [esp + 0x14]
lea esi, [esp + 0x74]
call fcn.00465a5e
call fcn.0047b570
movzx eax, byte [esp + 0x28]
test al, al
jne 0x47c7fd
lea edi, [esp]
lea esi, [esp + 0x74]
call fcn.00465a5e
lea edi, [esp + 0x14]
lea esi, [esp + 0x88]
call fcn.00465a5e
call fcn.0047b470
movzx eax, byte [esp + 0x28]
test al, al
je 0x47c7e3
mov dword [esp + 0xa0], 0x80000000
mov dword [esp + 0x9c], 0
add esp, 0x70
ret
mov dword [esp + 0xa0], 0x7fffffff
mov dword [esp + 0x9c], 0xffffffff
add esp, 0x70
ret
mov eax, dword [esp + 0x40]
mov dword [esp + 0xa0], eax
mov eax, dword [esp + 0x38]
mov dword [esp + 0x9c], eax
add esp, 0x70
ret
call fcn.00464070
jmp fcn.0047c5a0
Function at 0x492cf0
Capabilities:
Hash data using fnv

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x492d28
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 4]
xor ebx, ebx
jmp 0x492d1f
movzx ebp, byte [eax + ebx]
inc ebx
imul edx, edx, 0x1000193
xor edx, ebp
cmp ecx, ebx
jg 0x492d12
mov dword [esp + 0x14], edx
ret
call fcn.00464070
jmp fcn.00492cf0
Function at 0x49f1b0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x49f352
sub esp, 0xc
mov eax, dword [esp + 0x14]
cmp eax, 2
jl 0x49f287
mov ecx, dword [esp + 0x10]
movzx edx, byte [ecx]
cmp byte [ecx + 1], 0x3a
jne 0x49f20b
lea ebx, [edx - 0x30]
cmp bl, 9
jbe 0x49f1fb
lea ebx, [edx - 0x61]
cmp bl, 0x19
jbe 0x49f1fb
lea ebx, [edx - 0x41]
cmp bl, 0x19
ja 0x49f20b
mov dword [esp + 0x18], ecx
mov dword [esp + 0x1c], 2
add esp, 0xc
ret
cmp eax, 5
jge 0x49f214
xor edx, edx
jmp 0x49f22b
mov byte [esp], dl
call fcn.0049f040
movzx eax, byte [esp + 4]
mov ecx, dword [esp + 0x10]
mov edx, eax
mov eax, dword [esp + 0x14]
test dl, dl
jne 0x49f233
xor edx, edx
jmp 0x49f276
movzx eax, byte [ecx + 1]
mov byte [esp], al
call fcn.0049f040
movzx eax, byte [esp + 4]
test al, al
jne 0x49f254
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
xor edx, edx
jmp 0x49f276
mov eax, dword [esp + 0x10]
movzx ecx, byte [eax + 2]
mov byte [esp], cl
call fcn.0049f040
movzx eax, byte [esp + 4]
xor eax, 1
mov ecx, dword [esp + 0x10]
mov edx, eax
mov eax, dword [esp + 0x14]
test dl, dl
je 0x49f29b
cmp byte [ecx + 2], 0x2e
je 0x49f29b
mov edx, 3
jmp 0x49f2be
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
add esp, 0xc
ret
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
add esp, 0xc
ret
mov ebx, dword [esp + 8]
lea edx, [ebx + 1]
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
lea ebx, [eax - 1]
cmp edx, ebx
jge 0x49f29b
mov dword [esp + 8], edx
movzx eax, byte [ecx + edx]
mov byte [esp], al
call fcn.0049f040
movzx eax, byte [esp + 4]
test al, al
je 0x49f2af
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 8]
movzx edx, byte [ecx + eax + 1]
mov byte [esp], dl
call fcn.0049f040
movzx eax, byte [esp + 4]
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 8]
lea ebx, [edx + ecx + 1]
test al, al
jne 0x49f29b
cmp byte [ebx], 0x2e
je 0x49f29b
lea eax, [edx + 1]
jmp 0x49f31d
mov edx, dword [esp + 8]
lea eax, [edx + 1]
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
cmp edx, eax
jle 0x49f346
mov dword [esp + 8], eax
movzx edx, byte [eax + ecx]
mov byte [esp], dl
call fcn.0049f040
movzx eax, byte [esp + 4]
test al, al
je 0x49f312
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x18], ecx
mov dword [esp + 0x1c], eax
add esp, 0xc
ret
call fcn.00464070
jmp fcn.0049f1b0
Function at 0x4a15d0
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4a16ab
sub esp, 0x10
mov eax, dword [esp + 0x14]
movzx ecx, byte [eax + 4]
test cl, cl
je 0x4a168d
mov ecx, dword [eax + 0x10]
test ecx, ecx
je 0x4a168d
mov eax, dword [esp + 0x18]
mov dword [esp], eax
mov ecx, dword [esp + 0x1c]
mov dword [esp + 4], ecx
call fcn.00480fc0
mov eax, dword [esp + 0x14]
mov ecx, dword [eax + 0x10]
sub ecx, dword [esp + 8]
movzx edx, byte [eax + 6]
test dl, dl
je 0x4a165f
mov dword [esp + 0xc], ecx
mov ecx, dword [eax]
mov dword [esp], ecx
mov ecx, dword [esp + 0x18]
mov dword [esp + 4], ecx
mov ecx, dword [esp + 0x1c]
mov dword [esp + 8], ecx
call fcn.004a2e20
mov eax, dword [esp + 0x14]
mov dword [esp], eax
mov eax, dword [esp + 0xc]
mov dword [esp + 4], eax
call fcn.004a13a0
jmp 0x4a1689
mov dword [esp], eax
mov dword [esp + 4], ecx
call fcn.004a13a0
mov eax, dword [esp + 0x14]
mov eax, dword [eax]
mov dword [esp], eax
mov eax, dword [esp + 0x18]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x1c]
mov dword [esp + 8], eax
call fcn.004a2e20
add esp, 0x10
ret
mov eax, dword [eax]
mov dword [esp], eax
mov eax, dword [esp + 0x18]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x1c]
mov dword [esp + 8], eax
call fcn.004a2e20
add esp, 0x10
ret
call fcn.00464070
jmp fcn.004a15d0
Function at 0x4ad910
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4ada3a
sub esp, 0x1c
mov eax, dword [esp + 0x20]
movzx ecx, word [eax]
mov edx, dword [esp + 0x24]
mov dword [esp], edx
mov edx, dword [esp + 0x28]
mov dword [esp + 4], edx
mov edx, dword [esp + 0x2c]
mov dword [esp + 8], edx
mov word [esp + 0xc], cx
call fcn.004b02f0
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov ebx, dword [esp + 0x20]
movzx ebp, word [ebx + 2]
mov dword [esp], eax
mov dword [esp + 4], ecx
mov dword [esp + 8], edx
mov word [esp + 0xc], bp
call fcn.004b02f0
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov ebx, dword [esp + 0x20]
movzx ebp, word [ebx + 4]
mov dword [esp], eax
mov dword [esp + 4], ecx
mov dword [esp + 8], edx
mov word [esp + 0xc], bp
call fcn.004b02f0
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov ebx, dword [esp + 0x20]
movzx ebp, word [ebx + 6]
mov dword [esp], eax
mov dword [esp + 4], ecx
mov dword [esp + 8], edx
mov word [esp + 0xc], bp
call fcn.004b02f0
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov ebx, dword [esp + 0x20]
movzx ebp, word [ebx + 8]
mov dword [esp], eax
mov dword [esp + 4], ecx
mov dword [esp + 8], edx
mov word [esp + 0xc], bp
call fcn.004b02f0
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov ebx, dword [esp + 0x20]
movzx ebx, word [ebx + 0xa]
mov dword [esp], eax
mov dword [esp + 4], ecx
mov dword [esp + 8], edx
mov word [esp + 0xc], bx
call fcn.004b02f0
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], ecx
mov dword [esp + 0x38], edx
add esp, 0x1c
ret
call fcn.00464070
jmp fcn.004ad910
Function at 0x4aefc0
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4af11f
sub esp, 0x5c
lea edi, [esp + 0x7c]
xor eax, eax
call fcn.00465577
mov ecx, dword [esp + 0x60]
test ecx, ecx
je 0x4aeffa
mov ecx, dword [esp + 0x64]
mov edx, dword [esp + 0x68]
mov eax, dword [esp + 0x60]
jmp 0x4af023
lea eax, [0x4ec9a0]
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x200
call fcn.0044cc90
mov eax, dword [esp + 0xc]
xor ecx, ecx
mov edx, 0x200
mov dword [esp + 0x24], ecx
lea edi, [esp + 0x38]
mov ebx, eax
xor eax, eax
call fcn.00465577
mov dword [esp + 0x38], ebx
mov ecx, dword [esp + 0x24]
mov dword [esp + 0x3c], ecx
mov dword [esp + 0x40], edx
mov dword [esp + 0x54], ecx
lea ecx, [esp + 0x6c]
mov dword [esp], ecx
call fcn.004ad7f0
movzx ecx, word [esp + 4]
movzx edx, word [esp + 6]
mov word [esp + 0x46], cx
mov word [esp + 0x48], dx
mov dword [esp + 0x28], 0
mov dword [esp + 0x2c], 0
mov dword [esp + 0x30], 0
mov ecx, dword [esp + 0x3c]
lea edx, [ecx + 0xc]
mov ebx, dword [esp + 0x40]
mov ebp, dword [esp + 0x38]
cmp ebx, edx
jae 0x4af0c9
mov dword [esp + 0x24], ecx
mov dword [esp], ebp
mov dword [esp + 4], edx
mov dword [esp + 8], ebx
mov dword [esp + 0xc], 0xc
lea eax, [0x4ec9a0]
mov dword [esp + 0x10], eax
call fcn.0044cd30
mov ebp, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov ebx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x24]
mov dword [esp + 0x24], ebx
mov dword [esp + 0x34], ebp
mov dword [esp + 0x20], edx
lea eax, [ebp + ecx]
mov dword [esp], eax
lea eax, [esp + 0x28]
mov dword [esp + 4], eax
mov dword [esp + 8], 0xc
call fcn.00465c70
mov eax, dword [esp + 0x34]
mov dword [esp + 0x38], eax
mov eax, dword [esp + 0x20]
mov dword [esp + 0x3c], eax
mov eax, dword [esp + 0x24]
mov dword [esp + 0x40], eax
mov byte [esp + 0x44], 1
lea edi, [esp + 0x7c]
lea esi, [esp + 0x38]
call fcn.00465a36
add esp, 0x5c
ret
call fcn.00464070
jmp fcn.004aefc0
Function at 0x4c3520
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4c3693
sub esp, 0x48
mov eax, dword [esp + 0x78]
cmp eax, 4
jne 0x4c35b9
mov ecx, dword [esp + 0x74]
cmp dword [ecx], 0x6c616964
je 0x4c3558
mov edx, dword [esp + 0x64]
mov ebx, dword [esp + 0x68]
jmp 0x4c35c5
mov eax, dword [esp + 0x64]
mov ecx, dword [eax + 0x1c]
mov edx, dword [esp + 0x68]
mov dword [esp], edx
call ecx
movzx eax, byte [esp + 4]
test al, al
jne 0x4c3583
mov eax, dword [esp + 0x78]
mov ecx, dword [esp + 0x74]
mov edx, dword [esp + 0x64]
mov ebx, dword [esp + 0x68]
jmp 0x4c35c5
mov eax, dword [esp + 0x64]
mov eax, dword [eax + 0x24]
mov ecx, dword [esp + 0x68]
mov dword [esp], ecx
mov ecx, dword [esp + 0x54]
mov dword [esp + 4], ecx
mov edx, dword [esp + 0x58]
mov dword [esp + 8], edx
call eax
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov edx, eax
mov ebx, ecx
mov eax, dword [esp + 0x78]
mov ecx, dword [esp + 0x74]
jmp 0x4c35c5
mov ecx, dword [esp + 0x74]
mov edx, dword [esp + 0x64]
mov ebx, dword [esp + 0x68]
mov dword [esp + 0x44], ebx
mov dword [esp + 0x40], edx
mov ebp, dword [esp + 0x54]
mov dword [esp], ebp
mov esi, dword [esp + 0x58]
mov dword [esp + 4], esi
mov edi, dword [esp + 0x5c]
mov dword [esp + 8], edi
mov edi, dword [esp + 0x60]
mov dword [esp + 0xc], edi
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ecx
mov dword [esp + 0x1c], eax
call fcn.004c3390
mov eax, dword [esp + 0x20]
movzx ecx, byte [esp + 0x24]
mov edx, dword [esp + 0x4c]
mov dword [esp], edx
mov edx, dword [esp + 0x50]
mov dword [esp + 4], edx
mov edx, dword [esp + 0x54]
mov dword [esp + 8], edx
mov edx, dword [esp + 0x58]
mov dword [esp + 0xc], edx
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x6c]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x70]
mov dword [esp + 0x18], eax
mov byte [esp + 0x1c], cl
mov eax, dword [esp + 0x5c]
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x60]
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x40]
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x44]
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x7c]
mov dword [esp + 0x30], eax
call fcn.004ca0d0
mov eax, dword [esp + 0x34]
mov ecx, dword [esp + 0x38]
mov edx, dword [esp + 0x3c]
mov dword [esp + 0x80], eax
mov dword [esp + 0x84], ecx
mov dword [esp + 0x88], edx
add esp, 0x48
ret
call fcn.00464070
jmp fcn.004c3520
Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x42e00c
nop
pop eax
nop
nop
nop
nop
nop
add eax, 0x403ac5
nop
sub eax, 0x403a6b
mov ebx, dword [eax]
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
jl 0x42e030
nop
nop
nop
nop
nop
add eax, 0xc
cmp dword [eax], 0
nop
nop
nop
nop
nop
nop
nop
jne 0x42e01e
nop
nop
popal
nop
nop
nop
jmp int.00401219
Function at 0x4386a0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x14000]
push edi
or ebp, 0xffffffff
jmp 0x4386c2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x4386c9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4386b8
mov eax, 1
add ebx, ebx
jne 0x4386db
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x4386d0
jne 0x4386ec
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4386d0
xor ecx, ecx
sub eax, 3
jb 0x438700
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x438772
mov ebp, eax
add ebx, ebx
jne 0x43870b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x438718
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x43873c
inc ecx
add ebx, ebx
jne 0x438728
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x43871d
jne 0x438739
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x43871d
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x43875c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x43874d
jmp 0x4386be
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x43875c
add edi, ecx
jmp 0x4386be
pop esi
mov edi, esi
mov ecx, 0x90e
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x43877a
cmp byte [edi], 5
jne 0x43877a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x43877f
lea edi, [esi + 0x36000]
mov eax, dword [edi]
or eax, eax
je 0x4387ee
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x39774]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x397d8]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x4387ac
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x397dc]
or eax, eax
je 0x4387e8
mov dword [ebx], eax
add ebx, 4
jmp 0x4387c9
call dword [esi + 0x397ec]
mov ebp, dword [esi + 0x397e0]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x20f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x438822
sub esp, 0xffffff80
jmp 0x4077e0

Function at 0x430006
Capabilities:
Encode data using xor

Disassembly:
call 0x43000c
nop
nop
pop eax
nop
nop
nop
add eax, 0x403d6f
nop
nop
sub eax, 0x403d15
nop
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x430030
nop
nop
add eax, 0xc
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
nop
nop
jne 0x43001e
popal
nop
nop
nop
nop
nop
jmp loc.00401219