joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4515f0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x3b000]
push edi
or ebp, 0xffffffff
jmp 0x451612
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x451619
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x451608
mov eax, 1
add ebx, ebx
jne 0x45162b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x451620
jne 0x45163c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x451620
xor ecx, ecx
sub eax, 3
jb 0x451650
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x4516c2
mov ebp, eax
add ebx, ebx
jne 0x45165b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x451668
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x45168c
inc ecx
add ebx, ebx
jne 0x451678
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x45166d
jne 0x451689
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x45166d
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x4516ac
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x45169d
jmp 0x45160e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x4516ac
add edi, ecx
jmp 0x45160e
pop esi
mov edi, esi
mov ecx, 6
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x4516ca
cmp byte [edi], 0x32
jne 0x4516ca
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x4516cf
lea edi, [esi + 0x4f000]
mov eax, dword [edi]
or eax, eax
je 0x451747
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x51a80]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x51abc]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x4516fc
mov ecx, edi
jns 0x45172b
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x51ac0]
or eax, eax
je 0x451741
mov dword [ebx], eax
add ebx, 4
jmp 0x451719
call dword [esi + 0x51ad0]
mov ebp, dword [esi + 0x51ac4]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1cf]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x45177b
sub esp, 0xffffff80
jmp 0x401094

Function at 0x4015a0
Capabilities:
Terminate process

Disassembly:
call fcn.00401940
jmp fcn.004012d0

Function at 0x4015b0
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x403008]
jne 0x4015ba
repz ret
jmp fcn.004019f0
Function at 0x1002aadf
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
pushal
call 0x1002aaee
pop dword [ebp - 0x34]
mov eax, 0x6f5f3b2e
sub eax, 0x5f5c9040
sub dword [ebp - 0x34], eax
mov dword [ebp - 0x44], 0xae090e68
add dword [ebp - 0x44], 0xa04936e3
mov dword [ebp - 0x40], 0x41185843
add dword [ebp - 0x40], 0xf11af402
mov dword [ebp - 0x3c], 0x1091e65c
add dword [ebp - 0x3c], 0x3bba5dd2
mov dword [ebp - 0x38], 0xd4450c77
sub dword [ebp - 0x38], 0xd4450c77
lea eax, [ebp - 0x44]
push eax
mov eax, 0xd4886c28
add eax, 0x3b7a5410
add eax, dword [ebp - 0x34]
call dword [eax]
mov dword [ebp - 0x44], 0x1e60e811
sub dword [ebp - 0x44], 0xa9ee7ebb
mov dword [ebp - 0x40], 0x4d1cb7f
sub dword [ebp - 0x40], 0xc3656a0a
mov dword [ebp - 0x3c], 0x55faaa88
sub dword [ebp - 0x3c], 0xf28b3e1c
mov dword [ebp - 0x38], 0x2ec272c2
add dword [ebp - 0x38], 0xd13d8d3e
lea ebx, [ebp - 0x44]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x34]
call dword [eax]
push 0x40
push 0x1000
push 0x355b4
push 0
call eax
mov ecx, 0x438e
xor edx, edx
add edx, eax
mov esi, 0x10039600
add esi, dword [ebp - 0x34]
mov ebx, 0x57a816f3
add ebx, 0x6aa353dc
mov edi, dword [esi]
xor dword [ebp - 8], 0x3a5feef6
sub edi, ebx
add dword [ebp - 0x10], ebx
mov dword [edx], edi
add dword [ebp - 0x24], 0x36342986
add edx, 0xf7f35c8c
sub edx, 0xf7f35c88
add esi, 4
loop 0x1002ac01
add eax, 0x1010b
mov ebx, eax
add eax, 0x628eaa5
sub eax, 0x628eaa0
mov ecx, 0xa620da0a
add ecx, 0x69df25f6
add ecx, dword [ebp - 0x34]
call ebx
leave
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x401c57
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
pushal
call 0x401c66
pop dword [ebp - 0xc]
mov eax, 0x401c66
sub dword [ebp - 0xc], eax
mov dword [ebp - 0x1c], 0x76c145d8
add dword [ebp - 0x1c], 0xd790ff73
mov dword [ebp - 0x18], 0xff94edf
add dword [ebp - 0x18], 0x2239fd66
mov dword [ebp - 0x14], 0x2c7a205
sub dword [ebp - 0x14], 0xb67b5dd7
mov dword [ebp - 0x10], 0x84ff51fe
sub dword [ebp - 0x10], 0x84ff51fe
lea eax, [ebp - 0x1c]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0xc]
call dword [eax]
mov dword [ebp - 0x1c], 0x59875cb0
sub dword [ebp - 0x1c], 0xe514f35a
mov dword [ebp - 0x18], 0xf7825963
add dword [ebp - 0x18], 0x49ea0812
mov dword [ebp - 0x14], 0xa2dd5bba
add dword [ebp - 0x14], 0xc09210b2
mov dword [ebp - 0x10], 0xf2329994
add dword [ebp - 0x10], 0xdcd666c
lea ebx, [ebp - 0x1c]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0xc]
call dword [eax]
push 0x40
push 0x1000
push 0x371e6
push 0
call eax
mov ecx, 0xb1fcd3e2
sub ecx, 0xb1fc8955
mov edi, eax
mov esi, 0x407000
add esi, dword [ebp - 0xc]
mov ebx, 0x623567ce
sub ebx, 0x532f6f0d
xor dword [ebp - 8], 0xa3aee159
mov edx, dword [esi]
mov dword [ebp - 4], 0xcf1f2a1a
sub edx, ebx
add dword [ebp - 8], ebx
mov dword [edi], edx
sub dword [ebp - 8], edi
add edi, 0x34b9d89e
sub edi, 0x34b9d89a
add esi, 0x13a8c83b
sub esi, 0x13a8c837
loop 0x401d73
add eax, 0xc145aa30
sub eax, 0xc1448d29
mov ebx, eax
add eax, 5
mov ecx, 0x3b798863
add ecx, 0xc4c6779d
add ecx, dword [ebp - 0xc]
call ebx
leave
ret

Function at 0x401fb2
Capabilities:
Delete file
Move file

Disassembly:
mov ecx, 0x404f28
jmp fcn.0040170c

Function at 0x401ff6
Capabilities:
Check if file exists
Delete directory
Get file attributes

Disassembly:
push esi
mov esi, 0x404f28
push esi
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x402013
push esi
call dword [sym.imp.kernel32.dll_RemoveDirectoryW]
test eax, eax
je 0x402018
push 1
pop eax
pop esi
ret
call fcn.00401fb2
pop esi
ret
Function at 0x404eb9
Capabilities:
Enumerate files on windows

Disassembly:
push 0x270
mov eax, 0x41ef37
call fcn.0040dc60
mov dword [ebp - 0x278], ecx
xor ebx, ebx
push 0x103
lea eax, [ebp - 0x113]
push ebx
mov dword [ebp - 0x27c], ebx
push eax
mov byte [ebp - 0x114], bl
call fcn.0040f99c
add esp, 0xc
mov esi, 0x104
push esi
lea eax, [ebp - 0x114]
push eax
push ebx
call dword [sym.imp.kernel32.dll_GetModuleFileNameA]
test eax, eax
jne 0x404f10
xor eax, eax
jmp 0x40501d
lea eax, [ebp - 0x114]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecA]
push 0xffffffffffffffff
push 0x401328
lea eax, [ebp - 0x114]
push esi
push eax
call fcn.0041955c
add esp, 0x10
lea eax, [ebp - 0x270]
push eax
lea eax, [ebp - 0x114]
push eax
call dword [sym.imp.kernel32.dll_FindFirstFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x404f09
xor esi, esi
test byte [ebp - 0x270], 0x10
je 0x404fbb
and dword [ebp - 0x120], 0
lea ecx, [ebp - 0x244]
mov dword [ebp - 0x11c], 0xf
mov byte [ebp - 0x130], 0
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x404f7b
sub ecx, edx
push ecx
lea eax, [ebp - 0x244]
push eax
lea ecx, [ebp - 0x130]
call fcn.0041955c
and dword [ebp - 4], 0
lea eax, [ebp - 0x130]
or ebx, 1
push eax
mov dword [ebp - 0x27c], ebx
call fcn.0041955c
mov byte [ebp - 0x271], 1
test al, al
jne 0x404fc2
mov byte [ebp - 0x271], 0
or dword [ebp - 4], 0xffffffff
test bl, 1
je 0x404fdd
push 0
push 1
lea ecx, [ebp - 0x130]
and ebx, 0xfffffffe
call fcn.0041955c
cmp byte [ebp - 0x271], 0
je 0x404ffe
mov ecx, dword [ebp - 0x278]
lea eax, [ebp - 0x244]
push eax
call fcn.0041955c
mov esi, eax
test esi, esi
jne 0x405014
lea eax, [ebp - 0x270]
push eax
push edi
call dword [sym.imp.kernel32.dll_FindNextFileA]
test eax, eax
jne 0x404f51
push edi
call dword [sym.imp.kernel32.dll_FindClose]
mov eax, esi
call fcn.0040dce3
ret
Function at 0x40db9d
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42326c]
jne 0x4148e1
repz ret
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x328
mov dword [0x424d00], eax
mov dword [0x424cfc], ecx
mov dword [0x424cf8], edx
mov dword [0x424cf4], ebx
mov dword [0x424cf0], esi
mov dword [0x424cec], edi
mov word [0x424d18], ss
mov word [0x424d0c], cs
mov word [0x424ce8], ds
mov word [0x424ce4], es
mov word [0x424ce0], fs
mov word [0x424cdc], gs
pushfd
pop dword [0x424d10]
mov eax, dword [ebp]
mov dword [0x424d04], eax
mov eax, dword [ebp + 4]
mov dword [0x424d08], eax
lea eax, [ebp + 8]
mov dword [0x424d14], eax
mov eax, dword [ebp - 0x320]
mov dword [0x424c50], 0x10001
mov eax, dword [0x424d08]
mov dword [0x424c04], eax
mov dword [0x424bf8], 0xc0000409
mov dword [0x424bfc], 1
mov eax, dword [0x42326c]
mov dword [ebp - 0x328], eax
mov eax, dword [0x423270]
mov dword [ebp - 0x324], eax
call dword [sym.imp.kernel32.dll_IsDebuggerPresent]
mov dword [0x424c48], eax
push 1
call fcn.00419129
pop ecx
push 0
call dword [sym.imp.kernel32.dll_SetUnhandledExceptionFilter]
push 0x40279c
call dword [sym.imp.kernel32.dll_UnhandledExceptionFilter]
cmp dword [0x424c48], 0
jne 0x4149cd
push 1
call fcn.00419129
pop ecx
push 0xc0000409
call dword [sym.imp.kernel32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.kernel32.dll_TerminateProcess]
leave
ret

Function at 0x41955c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
pushal
call 0x41956b
pop dword [ebp - 0x3c]
mov eax, 0x41956b
sub dword [ebp - 0x3c], eax
mov dword [ebp - 0x4c], 0xd1b4c7c6
add dword [ebp - 0x4c], 0x7c9d7d85
mov dword [ebp - 0x48], 0x5a243046
add dword [ebp - 0x48], 0xd80f1bff
mov dword [ebp - 0x44], 0x87342e16
add dword [ebp - 0x44], 0xc5181618
mov dword [ebp - 0x40], 0x83bcf32d
add dword [ebp - 0x40], 0x7c430cd3
lea eax, [ebp - 0x4c]
push eax
mov eax, 0x9c3afd2b
sub eax, 0x9bfaeb97
add eax, dword [ebp - 0x3c]
call dword [eax]
mov dword [ebp - 0x4c], 0xc584900
sub dword [ebp - 0x4c], 0x97e5dfaa
mov dword [ebp - 0x48], 0x9ae02d82
sub dword [ebp - 0x48], 0x5973cc0d
mov dword [ebp - 0x44], 0x83e30b2f
add dword [ebp - 0x44], 0xdf8c613d
mov dword [ebp - 0x40], 0x2cf1895
add dword [ebp - 0x40], 0xfd30e76b
lea ebx, [ebp - 0x4c]
push ebx
push eax
mov eax, 0x7008d536
sub eax, 0x6fc8c50e
add eax, dword [ebp - 0x3c]
call dword [eax]
push 0x40
push 0x1000
push 0x3fc5a
push 0
call eax
mov ecx, 0x4da1
mov edi, eax
mov esi, 0x1428bd34
sub esi, 0x13e61734
add esi, dword [ebp - 0x3c]
mov ebx, 0xba22ff8b
add ebx, 0xdf3b5f39
mov edx, dword [esi]
xor dword [ebp - 0xc], eax
add edx, ebx
xor dword [ebp - 8], 0x7c1c864
mov dword [edi], edx
add dword [ebp - 0x10], 0x1f93a8d0
add edi, 4
add esi, 0xc83fc705
sub esi, 0xc83fc701
loop 0x419682
add eax, 0xbbb987cd
add eax, 0x4447a18a
mov ebx, eax
add eax, 0xa5b27e8
add eax, 0xf5a4d81d
mov ecx, 0x9ed9da76
add ecx, 0x6166258a
add ecx, dword [ebp - 0x3c]
call ebx
leave
ret
Function at 0x1001f760
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
pushal
call 0x1001f76f
pop dword [ebp - 0x14]
mov eax, 0x1001f76f
sub dword [ebp - 0x14], eax
mov dword [ebp - 0x24], 0xba7ccce3
sub dword [ebp - 0x24], 0x6c2a8798
mov dword [ebp - 0x20], 0x13f9cabc
add dword [ebp - 0x20], 0x1e398189
mov dword [ebp - 0x1c], 0xa12613b1
add dword [ebp - 0x1c], 0xab26307d
mov dword [ebp - 0x18], 0xdd9295e3
sub dword [ebp - 0x18], 0xdd9295e3
lea eax, [ebp - 0x24]
push eax
mov eax, 0x5be3e605
sub eax, 0x4be05511
add eax, dword [ebp - 0x14]
call dword [eax]
mov dword [ebp - 0x24], 0xf1e8fc00
add dword [ebp - 0x24], 0x82896d56
mov dword [ebp - 0x20], 0x2bec3574
add dword [ebp - 0x20], 0x15802c01
mov dword [ebp - 0x1c], 0x9c4fe097
sub dword [ebp - 0x1c], 0x38e0742b
mov dword [ebp - 0x18], 0x6240bbd4
add dword [ebp - 0x18], 0x9dbf442c
lea ebx, [ebp - 0x24]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x14]
call dword [eax]
push 0x40
push 0x1000
push 0x40044
push 0
call eax
mov ecx, 0x2b624568
sub ecx, 0x2b6202ab
xor esi, esi
add esi, eax
mov edi, 0x842372da
sub edi, 0x741e60da
add edi, dword [ebp - 0x14]
mov edx, 0x765fac7a
add edx, 0xf0fec1e6
xor dword [ebp - 4], 0xdb86cf82
mov ebx, dword [edi]
sub dword [ebp - 8], 0x6cd0fc65
sub ebx, edx
mov dword [ebp - 4], 0x53a7df3b
mov dword [esi], ebx
xor dword [ebp - 8], 0xd1e9ff91
add esi, 0xeec08bf7
add esi, 0x113f740d
add edi, 0x4a1a94a4
sub edi, 0x4a1a94a0
loop 0x1001f889
add eax, 0x168b81f8
sub eax, 0x168a8431
mov ebx, eax
add eax, 0xb582f1a1
add eax, 0x4a7d0e64
mov ecx, 0xa00b2e3a
add ecx, 0x6ff4d1c6
add ecx, dword [ebp - 0x14]
call ebx
leave
ret

Function at 0x10030836
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x10047018]
jne 0x10030840
repz ret
jmp fcn.10030e15
Function at 0x1000cf10
Capabilities:
Packed with generic packer

Disassembly:
cmp byte [esp + 8], 1
jne 0x1000d0dd
pushal
mov esi, section.UPX1
lea edi, [esi - 0xa000]
push edi
or ebp, 0xffffffff
jmp 0x1000cf3a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x1000cf41
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x1000cf30
mov eax, 1
add ebx, ebx
jne 0x1000cf53
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x1000cf48
jne 0x1000cf64
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x1000cf48
xor ecx, ecx
sub eax, 3
jb 0x1000cf78
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x1000cfea
mov ebp, eax
add ebx, ebx
jne 0x1000cf83
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x1000cf90
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x1000cfb4
inc ecx
add ebx, ebx
jne 0x1000cfa0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x1000cf95
jne 0x1000cfb1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x1000cf95
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x1000cfd4
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x1000cfc5
jmp 0x1000cf36
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x1000cfd4
add edi, ecx
jmp 0x1000cf36
pop esi
mov edi, esi
mov ecx, 0x2d2
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x1000cff2
cmp byte [edi], 0
jne 0x1000cff2
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x1000cff7
lea edi, [esi + 0xa000]
mov eax, dword [edi]
or eax, eax
je 0x1000d06f
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xd000]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xd050]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x1000d024
mov ecx, edi
jns 0x1000d053
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xd054]
or eax, eax
je 0x1000d069
mov dword [ebx], eax
add ebx, 4
jmp 0x1000d041
popal
xor eax, eax
ret 0xc
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x1000d0a0
cmp al, 0xef
ja 0x1000d093
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x1000d075
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x1000d082
mov ebp, dword [esi + 0xd058]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x217]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x1000d0d4
sub esp, 0xffffff80
jmp 0x10004515
Function at 0xfbf8c0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0xa6f000]
push edi
jmp 0xfbf8da
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0xfbf8e1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xfbf8d0
mov eax, 1
add ebx, ebx
jne 0xfbf8f3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0xfbf904
jne 0xfbf923
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xfbf923
dec eax
add ebx, ebx
jne 0xfbf910
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0xfbf8e8
add ebx, ebx
jne 0xfbf91f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0xfbf975
xor ecx, ecx
sub eax, 3
jb 0xfbf93b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0xfbf9aa
sar eax, 1
mov ebp, eax
jmp 0xfbf946
add ebx, ebx
jne 0xfbf946
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xfbf914
inc ecx
add ebx, ebx
jne 0xfbf954
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xfbf914
add ebx, ebx
jne 0xfbf961
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0xfbf956
jne 0xfbf972
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0xfbf956
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0xfbf994
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0xfbf986
jmp 0xfbf8d6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0xfbf994
add edi, ecx
jmp 0xfbf8d6
pop esi
mov edi, esi
mov ecx, 0x5c95
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0xfbf9b2
cmp byte [edi], 0x65
jne 0xfbf9b2
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0xfbf9b7
lea edi, [esi + 0xbbd000]
mov eax, dword [edi]
or eax, eax
je 0xfbfa2f
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xbc0024]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xbc0060]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0xfbf9e4
mov ecx, edi
jns 0xfbfa13
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xbc0068]
or eax, eax
je 0xfbfa29
mov dword [ebx], eax
add ebx, 4
jmp 0xfbfa01
call dword [esi + 0xbc0064]
mov ebp, dword [esi + 0xbc006c]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1d7]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0xfbfa63
sub esp, 0xffffff80
jmp 0x418744
Function at 0x405d9a
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x42c574], 0
push esi
jne 0x405dd1
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x405dab
mov dword [ecx*4 + 0x42c570], eax
inc ecx
cmp ecx, 0x100
jl 0x405da6
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x405e02
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x42c570]
xor eax, esi
inc ecx
dec edx
jne 0x405de4
pop edi
not eax
pop esi
ret 0xc

Function at 0x433005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
mov eax, section..text
nop
push 4
nop
nop
nop
pop edi
nop
nop
nop
nop
nop
nop
nop
nop
cmp eax, 0
je 0x433072
nop
nop
nop
nop
nop
mov ebx, 0x40de38
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x7f5757c7
nop
nop
nop
nop
nop
xor dword [eax], esi
add eax, edi
nop
nop
nop
nop
nop
nop
nop
nop
loop 0x433060
mov eax, section..rsrc
nop
cmp eax, 0
nop
nop
nop
nop
nop
nop
nop
je 0x4330d2
nop
mov ebx, 0x4304d8
nop
nop
nop
nop
mov ecx, ebx
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
push eax
mov eax, ecx
nop
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x31ad007f
nop
nop
nop
nop
nop
xor dword [eax], esi
add eax, edi
nop
nop
nop
nop
loop 0x4330c0
nop
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x431219
Function at 0x1001cf50
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x100df320]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
cmp ebx, 0xffffffff
jne 0x1001cf80
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100a7270
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esi + 0x20]
mov eax, dword [eax]
test eax, eax
je 0x1001cfb0
mov edx, dword [esi + 0x30]
mov edx, dword [edx]
add edx, eax
cmp eax, edx
jae 0x1001cfb0
call dword [sym.imp.MSVCP140.dll_protected:_char____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::_Pninc_void_]
pop esi
mov byte [eax], bl
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100a7270
mov esp, ebp
pop ebp
ret 4
cmp dword [esi + 0x4c], 0
push edi
je 0x1001d0ab
mov edi, dword [esi + 0xc]
lea eax, [esi + 0x3c]
cmp dword [edi], eax
jne 0x1001cfd9
mov edx, dword [esi + 0x54]
mov ecx, dword [esi + 0x50]
sub edx, ecx
mov dword [edi], ecx
mov eax, dword [esi + 0x1c]
mov dword [eax], ecx
mov eax, dword [esi + 0x2c]
mov dword [eax], edx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x1001d00d
push dword [esi + 0x4c]
movsx eax, bl
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
add esp, 8
or ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100a7270
mov esp, ebp
pop ebp
ret 4
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x28], bl
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x27]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet___char_const___char_const___char_const____char___char___char___const]
sub eax, 0
je 0x1001d06c
sub eax, 1
je 0x1001d06c
sub eax, 2
jne 0x1001d0ab
push dword [esi + 0x4c]
push dword [ebp - 0x28]
call fcn.10070720
add esp, 8
or ecx, 0xffffffff
test al, al
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100a7270
mov esp, ebp
pop ebp
ret 4
mov edi, dword [ebp - 0x2c]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x1001d08a
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x1001d0ab
lea eax, [ebp - 0x28]
mov byte [esi + 0x3d], 1
cmp dword [ebp - 0x30], eax
je 0x1001d0ab
pop edi
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100a7270
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 4]
or eax, 0xffffffff
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100a7270
mov esp, ebp
pop ebp
ret 4