joyce8/EMBER2024-capa huggingface dataset:
Function at 0x414dd0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x433ea8
mov eax, dword fs:[0]
push eax
sub esp, 0x10
mov eax, dword [0x448008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x14], 0
lea ecx, [ebp - 0x10]
call fcn.00406a40
mov dword [ebp - 4], 0
call fcn.00414760
mov dword [ebp - 0x1c], eax
push 0
push 0x1a
push 0x200
lea ecx, [ebp - 0x10]
call fcn.00406250
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push 0xffffffffffffffff
lea ecx, [ebp - 0x10]
call fcn.00405e50
lea ecx, [ebp - 0x10]
call fcn.00402bc0
movzx eax, al
test eax, eax
je 0x414e73
push 0x43e214
mov ecx, dword [ebp + 8]
call fcn.00405d60
mov ecx, dword [ebp - 0x14]
or ecx, 1
mov dword [ebp - 0x14], ecx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.00406270
mov eax, dword [ebp + 8]
jmp 0x414fb9
lea ecx, [ebp - 0x10]
call fcn.00405ac0
sub eax, 1
push eax
lea ecx, [ebp - 0x10]
call fcn.004130f0
movzx edx, ax
cmp edx, 0x5c
je 0x414e9c
push 0x43e218
lea ecx, [ebp - 0x10]
call fcn.00402b80
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x18]
sub ecx, 1
mov dword [ebp - 0x18], ecx
cmp dword [ebp - 0x18], 3
ja case.default.0x414eb8
mov edx, dword [ebp - 0x18]
jmp dword [edx*4 + 0x414fc8]
push 0x43e21c
lea ecx, [ebp - 0x10]
call fcn.00402b80
push eax
mov ecx, dword [ebp + 8]
call fcn.00405610
mov eax, dword [ebp - 0x14]
or eax, 1
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.00406270
mov eax, dword [ebp + 8]
jmp 0x414fb9
push str.6789Zip_
lea ecx, [ebp - 0x10]
call fcn.00402b80
push eax
mov ecx, dword [ebp + 8]
call fcn.00405610
mov ecx, dword [ebp - 0x14]
or ecx, 1
mov dword [ebp - 0x14], ecx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.00406270
mov eax, dword [ebp + 8]
jmp 0x414fb9
push str.6789WallPaper_
lea ecx, [ebp - 0x10]
call fcn.00402b80
push eax
mov ecx, dword [ebp + 8]
call fcn.00405610
mov edx, dword [ebp - 0x14]
or edx, 1
mov dword [ebp - 0x14], edx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.00406270
mov eax, dword [ebp + 8]
jmp 0x414fb9
push str.6789pencil_
lea ecx, [ebp - 0x10]
call fcn.00402b80
push eax
mov ecx, dword [ebp + 8]
call fcn.00405610
mov eax, dword [ebp - 0x14]
or eax, 1
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.00406270
mov eax, dword [ebp + 8]
jmp 0x414fb9
push 0x43e284
mov ecx, dword [ebp + 8]
call fcn.00405d60
mov ecx, dword [ebp - 0x14]
or ecx, 1
mov dword [ebp - 0x14], ecx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.00406270
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x4277ad
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0042746d

Function at 0x407f80
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x6000]
push edi
or ebp, 0xffffffff
jmp 0x407fa2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x407fa9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x407f98
mov eax, 1
add ebx, ebx
jne 0x407fbb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x407fb0
jne 0x407fcc
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x407fb0
xor ecx, ecx
sub eax, 3
jb 0x407fe0
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x408052
mov ebp, eax
add ebx, ebx
jne 0x407feb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x407ff8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x40801c
inc ecx
add ebx, ebx
jne 0x408008
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x407ffd
jne 0x408019
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x407ffd
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x40803c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x40802d
jmp 0x407f9e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x40803c
add edi, ecx
jmp 0x407f9e
pop esi
mov edi, esi
mov ecx, 0x8f
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x40805a
cmp byte [edi], 0
jne 0x40805a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x40805f
lea edi, [esi + 0x5000]
mov eax, dword [edi]
or eax, eax
je 0x4080d7
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x8d64]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x8ddc]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x40808c
mov ecx, edi
jns 0x4080bb
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x8de4]
or eax, eax
je 0x4080d1
mov dword [ebx], eax
add ebx, 4
jmp 0x4080a9
call dword [esi + 0x8de0]
mov ebp, dword [esi + 0x8de8]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x217]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x40810b
sub esp, 0xffffff80
jmp 0x402130
Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
push 4
nop
nop
nop
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
cmp eax, 0
nop
nop
nop
je 0x432072
nop
nop
mov ebx, 0x40c7d0
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
push eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
mov esi, 0xc5505ca
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x432060
nop
nop
mov eax, section..tls
nop
nop
cmp eax, 0
nop
nop
je 0x4320d2
nop
nop
nop
nop
mov ebx, 0x42f314
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x79874e9b
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x4320c0
nop
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x431219
Function at 0x401f10
Capabilities:
Get disk information
Inspect load icon resource
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x148
push ebx
push esi
push edi
push 0x65
push eax
call dword [sym.imp.USER32.dll_LoadIconA]
lea ecx, [esp + 0xc]
call fcn.00401000
lea ecx, [esp + 0x50]
push 0x104
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edx, [esp + 0x50]
lea ecx, [esp + 0xc]
push edx
call fcn.004012b0
test eax, eax
je 0x402021
lea eax, [esp + 0x50]
push 0x404030
push eax
call dword [sym.imp.MSVCRT.dll_fopen]
mov esi, eax
add esp, 8
test esi, esi
je 0x402084
lea ecx, [esp + 0x50]
push ecx
lea ecx, [esp + 0x10]
call fcn.00401290
mov edi, dword [sym.imp.MSVCRT.dll_fseek]
sub eax, 8
push 0
push eax
push esi
call edi
mov ebx, dword [sym.imp.MSVCRT.dll_fread]
push esi
push 1
lea edx, [esp + 0x24]
push 8
push edx
call ebx
mov eax, dword [esp + 0x2c]
push 0
push eax
push esi
call edi
push esi
push 1
lea ecx, [esp + 0x48]
push 0x38
push ecx
call ebx
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
mov eax, dword [esp + 0x88]
mov edx, dword [esp + 0x50]
add esp, 0x3c
test eax, eax
mov eax, dword [esp + 0x10]
push edx
push eax
jne 0x401ffe
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401800
jmp 0x402084
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401a90
jmp 0x402084
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString_1
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov edi, eax
mov esi, 1
xor ebx, ebx
test edi, esi
je 0x40206a
mov dl, bl
lea ecx, [esp + 0x10]
add dl, 0x41
push edx
call sub.MFC42.DLL_CString::operator_1
push 0x40412c
lea ecx, [esp + 0x14]
call fcn.004020e2
lea ecx, [esp + 0xc]
mov eax, dword [esp + 0x10]
push eax
push 0
call fcn.00401cf0
add esi, esi
inc ebx
cmp ebx, 0x1a
jl 0x402039
lea ecx, [esp + 0xc]
call fcn.00401040
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0xc]
call fcn.00401030
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x148
ret 0x10

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x408e84
mov ecx, 0x53266ded
nop
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x43004e
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x430024
nop
mov eax, section..data
nop
nop
mov ebx, 0x42e1d0
nop
mov ecx, 0xb8b3fc1
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x430084
nop
nop
nop
xor dword [eax], ecx
nop
nop
add eax, 4
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x43006c
nop
nop
nop
nop
nop
popal
jmp 0x401219
Function at 0x401006
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42e004]
jne 0x401010
repz ret
jmp fcn.004018d1

Function at 0x40a075
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00404384
and dword [ebp - 4], 0
cmp dword [0x4307f4], 0
mov ebx, eax
jne 0x40a126
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x40a1d7
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x40a1d7
push eax
call fcn.00404312
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x4307f4], eax
call esi
push eax
call fcn.00404312
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x4307f8], eax
call esi
push eax
call fcn.00404312
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x4307fc], eax
call esi
push eax
call fcn.00404312
pop ecx
mov dword [0x430804], eax
test eax, eax
je 0x40a126
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00404312
pop ecx
mov dword [0x430800], eax
mov eax, dword [0x430800]
cmp eax, ebx
je 0x40a17e
cmp dword [0x430804], ebx
je 0x40a17e
push eax
call fcn.0040438d
push dword [0x430804]
mov esi, eax
call fcn.0040438d
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x40a17e
test edi, edi
je 0x40a17e
call esi
test eax, eax
je 0x40a175
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x40a175
test byte [ebp - 0xc], 1
jne 0x40a17e
or dword [ebp + 0x10], 0x200000
jmp 0x40a1b7
mov eax, dword [0x4307f8]
cmp eax, ebx
je 0x40a1b7
push eax
call fcn.0040438d
pop ecx
test eax, eax
je 0x40a1b7
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x40a1b7
mov eax, dword [0x4307fc]
cmp eax, ebx
je 0x40a1b7
push eax
call fcn.0040438d
pop ecx
test eax, eax
je 0x40a1b7
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x4307f4]
call fcn.0040438d
pop ecx
test eax, eax
je 0x40a1d7
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x40a1d9
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x4252c8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x808
mov eax, dword [0x42e004]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 8], 0x19f
jne 0x4252ec
push 0
call dword [sym.imp.KERNEL32.dll_GetNumaHighestNodeNumber]
push edi
xor edi, edi
cmp dword [ebp + 8], edi
jle 0x425317
push esi
and dword [ebp - 0x808], 0
lea esi, [ebp - 0x808]
call fcn.004252bd
mov al, byte [ebp - 0x808]
xor byte [ebx + edi], al
inc edi
cmp edi, dword [ebp + 8]
jl 0x4252f5
pop esi
cmp dword [ebp + 8], 0x2d
pop edi
jne 0x42534a
lea eax, [ebp - 0x808]
push eax
lea eax, [ebp - 0x804]
push eax
push str.tojidagaresijodujenut
push 0
call dword [sym.imp.ADVAPI32.dll_GetServiceKeyNameW]
or dword [0x43e76c], 0xffffffff
mov dword [0x43e768], 0xa62e7790
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401006
leave
ret
Function at 0x42e005
Capabilities:
Encode data using xor

Disassembly:
pushal
nop
mov eax, section..text
nop
mov ebx, 0x407ef8
mov ecx, 0x36363e67
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x42e04e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x42e024
nop
nop
nop
mov eax, section..data
mov ebx, 0x42cd70
nop
nop
mov ecx, 0x5de806a7
nop
test eax, eax
nop
nop
nop
nop
je 0x42e084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x42e06c
nop
nop
popal
nop
nop
nop
jmp 0x401219
Function at 0x4144a0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x11000]
push edi
jmp 0x4144ba
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x4144c1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4144b0
mov eax, 1
add ebx, ebx
jne 0x4144d3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x4144c8
jne 0x4144e4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4144c8
xor ecx, ecx
sub eax, 3
jb 0x4144f8
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x41456a
mov ebp, eax
add ebx, ebx
jne 0x414503
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x414510
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x414534
inc ecx
add ebx, ebx
jne 0x414520
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x414515
jne 0x414531
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x414515
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x414554
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x414545
jmp 0x4144b6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x414554
add edi, ecx
jmp 0x4144b6
pop esi
lea edi, [esi + 0x12000]
mov eax, dword [edi]
or eax, eax
je 0x4145bc
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x14790]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x1484c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x414571
mov ecx, edi
jns 0x4145a0
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x14854]
or eax, eax
je 0x4145b6
mov dword [ebx], eax
add ebx, 4
jmp 0x41458e
call dword [esi + 0x14850]
mov ebp, dword [esi + 0x14858]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x207]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x4145f0
sub esp, 0xffffff80
jmp 0x403966

Function at 0x431005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
call 0x43100c
pop eax
nop
nop
nop
nop
nop
nop
add eax, 0x403e6a
sub eax, 0x403e10
nop
nop
nop
nop
mov ebx, dword [eax]
nop
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
jl 0x431030
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
nop
cmp dword [eax], 0
nop
jne 0x43101e
nop
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp loc.00401219
Function at 0x4f2020
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x9b000]
push edi
jmp 0x4f203a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x4f2041
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4f2030
mov eax, 1
add ebx, ebx
jne 0x4f2053
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x4f2064
jne 0x4f2083
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4f2083
dec eax
add ebx, ebx
jne 0x4f2070
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x4f2048
add ebx, ebx
jne 0x4f207f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x4f20d5
xor ecx, ecx
sub eax, 3
jb 0x4f209b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x4f210a
sar eax, 1
mov ebp, eax
jmp 0x4f20a6
add ebx, ebx
jne 0x4f20a6
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4f2074
inc ecx
add ebx, ebx
jne 0x4f20b4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4f2074
add ebx, ebx
jne 0x4f20c1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x4f20b6
jne 0x4f20d2
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4f20b6
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x4f20f4
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x4f20e6
jmp 0x4f2036
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x4f20f4
add edi, ecx
jmp 0x4f2036
pop esi
mov edi, esi
mov ecx, 0x3ea9
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x4f2112
cmp byte [edi], 0x11
jne 0x4f2112
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x4f2117
lea edi, [esi + 0xeb000]
mov eax, dword [edi]
or eax, eax
je 0x4f218f
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x10b0c4]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x10b240]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x4f2144
mov ecx, edi
jns 0x4f2173
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x10b244]
or eax, eax
je 0x4f2189
mov dword [ebx], eax
add ebx, 4
jmp 0x4f2161
call dword [esi + 0x10b254]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x4f21c0
cmp al, 0xef
ja 0x4f21b3
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x4f2195
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x4f21a2
mov ebp, dword [esi + 0x10b248]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x22f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x4f21f4
sub esp, 0xffffff80
jmp 0x42800a
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
push 4
nop
nop
nop
nop
nop
nop
nop
nop
nop
pop edi
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x430072
nop
nop
mov ebx, 0x408ecc
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
nop
mov esi, 0x42c81810
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x430060
mov eax, section..data
nop
nop
nop
cmp eax, 0
nop
nop
nop
je 0x4300d2
nop
nop
mov ebx, 0x42e1d0
nop
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x459556aa
nop
nop
nop
xor dword [eax], esi
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
nop
loop 0x4300c0
nop
nop
nop
nop
nop
nop
popal
jmp 0x401219
Function at 0x44c4c0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x31000]
push edi
jmp 0x44c4da
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x44c4e1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x44c4d0
mov eax, 1
add ebx, ebx
jne 0x44c4f3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x44c504
jne 0x44c523
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x44c523
dec eax
add ebx, ebx
jne 0x44c510
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x44c4e8
add ebx, ebx
jne 0x44c51f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x44c575
xor ecx, ecx
sub eax, 3
jb 0x44c53b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x44c5aa
sar eax, 1
mov ebp, eax
jmp 0x44c546
add ebx, ebx
jne 0x44c546
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x44c514
inc ecx
add ebx, ebx
jne 0x44c554
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x44c514
add ebx, ebx
jne 0x44c561
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x44c556
jne 0x44c572
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x44c556
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x44c594
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x44c586
jmp 0x44c4d6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x44c594
add edi, ecx
jmp 0x44c4d6
pop esi
mov edi, esi
mov ecx, 0x104a
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x44c5b2
cmp byte [edi], 0xc
jne 0x44c5b2
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x44c5b7
lea edi, [esi + 0x48000]
mov eax, dword [edi]
or eax, eax
je 0x44c626
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x4eee4]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x4ef98]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x44c5e4
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x4ef9c]
or eax, eax
je 0x44c620
mov dword [ebx], eax
add ebx, 4
jmp 0x44c601
call dword [esi + 0x4efac]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x44c657
cmp al, 0xef
ja 0x44c64a
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x44c62c
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x44c639
mov ebp, dword [esi + 0x4efa0]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x20f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x44c68b
sub esp, 0xffffff80
jmp 0x413e3c