joyce8/EMBER2024-capa huggingface dataset:
Function at 0x55b170
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x104000]
push edi
jmp 0x55b18a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x55b191
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x55b180
mov eax, 1
add ebx, ebx
jne 0x55b1a3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x55b1b4
jne 0x55b1d3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x55b1d3
dec eax
add ebx, ebx
jne 0x55b1c0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x55b198
add ebx, ebx
jne 0x55b1cf
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x55b225
xor ecx, ecx
sub eax, 3
jb 0x55b1eb
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x55b25a
sar eax, 1
mov ebp, eax
jmp 0x55b1f6
add ebx, ebx
jne 0x55b1f6
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x55b1c4
inc ecx
add ebx, ebx
jne 0x55b204
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x55b1c4
add ebx, ebx
jne 0x55b211
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x55b206
jne 0x55b222
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x55b206
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x55b244
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x55b236
jmp 0x55b186
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x55b244
add edi, ecx
jmp 0x55b186
pop esi
mov edi, esi
mov ecx, 0x3ea9
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x55b262
cmp byte [edi], 0x11
jne 0x55b262
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x55b267
lea edi, [esi + 0x154000]
mov eax, dword [edi]
or eax, eax
je 0x55b2df
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x1dd498]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x1dd614]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x55b294
mov ecx, edi
jns 0x55b2c3
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x1dd618]
or eax, eax
je 0x55b2d9
mov dword [ebx], eax
add ebx, 4
jmp 0x55b2b1
call dword [esi + 0x1dd628]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x55b310
cmp al, 0xef
ja 0x55b303
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x55b2e5
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x55b2f2
mov ebp, dword [esi + 0x1dd61c]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x22f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x55b344
sub esp, 0xffffff80
jmp 0x42800a
Function at 0x407010
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
push ebx
push esi
push edi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
movzx ebx, word [ecx + 6]
add eax, 0x18
add eax, ecx
test ebx, ebx
je 0x40704e
mov edi, dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
cmp edi, esi
jb 0x407046
mov ecx, dword [eax + 8]
add ecx, esi
cmp edi, ecx
jb 0x407050
inc edx
add eax, 0x28
cmp edx, ebx
jb 0x407036
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x407120
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
mov eax, 0x5a4d
cmp word [ecx], ax
jne 0x407151
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x407151
mov ecx, 0x10b
cmp word [eax + 0x18], cx
jne 0x407151
mov eax, 1
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x438cb6
Capabilities:
Encode data using xor

Disassembly:
mov ecx, 0x438a14
and eax, edx
sub eax, eax
call fcn.00438ce9
sub edx, 0xadcef766
xor dword [esi], ecx
add eax, 0xac57dd4d
mov edx, 0xb9d9a922
inc esi
add edx, edx
cmp esi, ebx
jne fcn.00438cb6
or eax, eax
add eax, edx
mov eax, eax
ret
Function at 0x467d90
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, 0x417015
lea edi, [esi - 0x16015]
push edi
jmp 0x467daa
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x467db1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x467da0
mov eax, 1
add ebx, ebx
jne 0x467dc3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x467dd4
jne 0x467df3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x467df3
dec eax
add ebx, ebx
jne 0x467de0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x467db8
add ebx, ebx
jne 0x467def
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x467e45
xor ecx, ecx
sub eax, 3
jb 0x467e0b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x467e7a
sar eax, 1
mov ebp, eax
jmp 0x467e16
add ebx, ebx
jne 0x467e16
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x467de4
inc ecx
add ebx, ebx
jne 0x467e24
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x467de4
add ebx, ebx
jne 0x467e31
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x467e26
jne 0x467e42
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x467e26
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x467e64
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x467e56
jmp 0x467da6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x467e64
add edi, ecx
jmp 0x467da6
pop esi
mov edi, esi
mov ecx, 7
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x467e82
cmp byte [edi], 1
jne 0x467e82
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x467e87
mov ebp, dword [esi + 0x676d4]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x19f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x467ee2
sub esp, 0xffffff80
jmp 0x407c28
Function at 0x435e60
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, 0x415015
lea edi, [esi - 0x14015]
lea eax, [edi + 0x15080]
push dword [eax]
mov dword [eax], 0xdc7403ff
push eax
push edi
or ebp, 0xffffffff
jmp 0x435e92
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x435e99
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x435e88
mov eax, 1
add ebx, ebx
jne 0x435eab
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x435ea0
jne 0x435ebc
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x435ea0
xor ecx, ecx
sub eax, 3
jb 0x435ed0
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x435f42
mov ebp, eax
add ebx, ebx
jne 0x435edb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x435ee8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x435f0c
inc ecx
add ebx, ebx
jne 0x435ef8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x435eed
jne 0x435f09
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x435eed
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x435f2c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x435f1d
jmp 0x435e8e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x435f2c
add edi, ecx
jmp 0x435e8e
pop esi
pop edi
pop eax
mov dword [edi], eax
lea edi, [esi + 0x33000]
mov eax, dword [edi]
or eax, eax
je 0x435f8f
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x37150]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x371b4]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x435f4d
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x371bc]
or eax, eax
je 0x435f89
mov dword [ebx], eax
add ebx, 4
jmp 0x435f6a
call dword [esi + 0x371b8]
mov ebp, dword [esi + 0x371c0]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x19f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
lea ebx, [esi - 0x1000]
lea edi, [ebx + 0x35fea]
push edi
xor eax, eax
stosb byte es:[edi], al
pop ecx
dec ecx
push eax
push 1
push ebx
call ecx
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x435fdb
sub esp, 0xffffff80
jmp 0x414ac0
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
nop
push 4
nop
nop
pop edi
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x430072
nop
nop
mov ebx, 0x408e84
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x7def7b76
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
add eax, edi
nop
nop
loop 0x430060
nop
nop
nop
nop
nop
mov eax, section..data
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x4300d2
mov ebx, 0x42e1d0
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x420957d9
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
nop
loop 0x4300c0
nop
nop
nop
popal
nop
nop
nop
jmp 0x401219

Function at 0x401b66
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x410004]
jne 0x401b70
repz ret
jmp fcn.0040324d

Function at 0x403508
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
pushal
call 0x403517
pop dword [ebp - 0x20]
mov eax, 0xf759a05c
sub eax, 0xf7196b45
sub dword [ebp - 0x20], eax
mov dword [ebp - 0x30], 0x3b4dd223
sub dword [ebp - 0x30], 0xecfb8cd8
mov dword [ebp - 0x2c], 0x93827b05
add dword [ebp - 0x2c], 0x9eb0d140
mov dword [ebp - 0x28], 0x19ae8581
add dword [ebp - 0x28], 0x329dbead
mov dword [ebp - 0x24], 0xe98cbe79
add dword [ebp - 0x24], 0x16734187
lea eax, [ebp - 0x30]
push eax
mov eax, sym.imp.kernel32.dll_LoadLibraryA
add eax, dword [ebp - 0x20]
call dword [eax]
mov dword [ebp - 0x30], 0xd76b2166
sub dword [ebp - 0x30], 0x62f8b810
mov dword [ebp - 0x2c], 0x56a374fe
add dword [ebp - 0x2c], 0xeac8ec77
mov dword [ebp - 0x28], 0x6b865c48
sub dword [ebp - 0x28], 0x816efdc
mov dword [ebp - 0x24], 0x92aba6d
add dword [ebp - 0x24], 0xf6d54593
lea ebx, [ebp - 0x30]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x20]
call dword [eax]
push 0x40
push 0x1000
push 0x3ae30
push 0
call eax
mov ecx, 0x4d70
mov ebx, eax
mov esi, 0xbb106bd7
sub esi, 0xbacebbd7
add esi, dword [ebp - 0x20]
mov edi, 0xf11d2b02
add edi, 0x16e3d43a
xor dword [ebp - 0x1c], ebx
mov edx, dword [esi]
mov dword [ebp - 0x10], 0x4766310c
xor edx, edi
xor dword [ebp - 0x14], edx
mov dword [ebx], edx
mov dword [ebp - 4], 0xb9ad5cb5
add ebx, 4
add esi, 0x5070cac0
sub esi, 0x5070cabc
loop 0x403629
add eax, 0x7c4c6bc9
sub eax, 0x7c4b4336
xor ebx, ebx
add ebx, eax
add eax, 0x45c6b65d
sub eax, 0x45c6b658
mov ecx, 0x40a9f91a
sub ecx, 0x4069f91a
add ecx, dword [ebp - 0x20]
call ebx
leave
ret
Function at 0x4659a0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, 0x457015
lea edi, [esi - 0x56015]
push edi
or ebp, 0xffffffff
jmp 0x4659c2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x4659c9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4659b8
mov eax, 1
add ebx, ebx
jne 0x4659db
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x4659d0
jne 0x4659ec
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4659d0
xor ecx, ecx
sub eax, 3
jb 0x465a00
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x465a72
mov ebp, eax
add ebx, ebx
jne 0x465a0b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x465a18
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x465a3c
inc ecx
add ebx, ebx
jne 0x465a28
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x465a1d
jne 0x465a39
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x465a1d
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x465a5c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x465a4d
jmp 0x4659be
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x465a5c
add edi, ecx
jmp 0x4659be
pop esi
mov edi, esi
mov ecx, 0x33e
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x465a7a
cmp byte [edi], 0
jne 0x465a7a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov eax, ebx
loop 0x465a7f
lea edi, [esi + 0x63000]
mov eax, dword [edi]
or eax, eax
je 0x465aee
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x651f0]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x65254]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x465aac
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x65258]
or eax, eax
je 0x465ae8
mov dword [ebx], eax
add ebx, 4
jmp 0x465ac9
call dword [esi + 0x6525c]
popal
jmp 0x40da18

Function at 0x5d8abd
Capabilities:
Encode data using xor

Disassembly:
mov esi, 0x5d87dc
mov ecx, 0xd960efa2
sub ecx, ecx
add edi, 1
call fcn.005d8b0d
add edi, 0x65f96e2f
sub edi, 0x55ed1051
dec ecx
xor dword [ebx], esi
sub edi, edi
add edi, edi
add ebx, 2
add edi, ecx
mov ecx, 0xd76cb837
add edi, 0x74715951
cmp ebx, eax
jl fcn.005d8abd
sub edi, ecx
ret
Function at 0x406fdb
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42b708]
jne 0x406fe5
repz ret
jmp fcn.0040eb2c

Function at 0x4108a7
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0040875d
and dword [ebp - 4], 0
cmp dword [0x42da30], 0
mov ebx, eax
jne 0x410958
push 0x4037fc
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x410a09
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x4037f0
push edi
call esi
test eax, eax
je 0x410a09
push eax
call fcn.004086eb
mov dword [esp], 0x4037e0
push edi
mov dword [0x42da30], eax
call esi
push eax
call fcn.004086eb
mov dword [esp], 0x4037cc
push edi
mov dword [0x42da34], eax
call esi
push eax
call fcn.004086eb
mov dword [esp], 0x4037b0
push edi
mov dword [0x42da38], eax
call esi
push eax
call fcn.004086eb
pop ecx
mov dword [0x42da40], eax
test eax, eax
je 0x410958
push 0x403798
push edi
call esi
push eax
call fcn.004086eb
pop ecx
mov dword [0x42da3c], eax
mov eax, dword [0x42da3c]
cmp eax, ebx
je 0x4109b0
cmp dword [0x42da40], ebx
je 0x4109b0
push eax
call fcn.00408766
push dword [0x42da40]
mov esi, eax
call fcn.00408766
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x4109b0
test edi, edi
je 0x4109b0
call esi
test eax, eax
je 0x4109a7
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x4109a7
test byte [ebp - 0xc], 1
jne 0x4109b0
or dword [ebp + 0x10], 0x200000
jmp 0x4109e9
mov eax, dword [0x42da34]
cmp eax, ebx
je 0x4109e9
push eax
call fcn.00408766
pop ecx
test eax, eax
je 0x4109e9
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x4109e9
mov eax, dword [0x42da38]
cmp eax, ebx
je 0x4109e9
push eax
call fcn.00408766
pop ecx
test eax, eax
je 0x4109e9
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x42da30]
call fcn.00408766
pop ecx
test eax, eax
je 0x410a09
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x410a0b
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4e9ff0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, 0x443015
lea edi, [esi - 0x42015]
add word [edi + 0xf84a0], 5
push edi
jmp 0x4ea012
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x4ea019
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4ea008
mov eax, 1
add ebx, ebx
jne 0x4ea02b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x4ea03c
jne 0x4ea05b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4ea05b
dec eax
add ebx, ebx
jne 0x4ea048
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x4ea020
add ebx, ebx
jne 0x4ea057
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x4ea0ad
xor ecx, ecx
sub eax, 3
jb 0x4ea073
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x4ea0e2
sar eax, 1
mov ebp, eax
jmp 0x4ea07e
add ebx, ebx
jne 0x4ea07e
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4ea04c
inc ecx
add ebx, ebx
jne 0x4ea08c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4ea04c
add ebx, ebx
jne 0x4ea099
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x4ea08e
jne 0x4ea0aa
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4ea08e
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x4ea0cc
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x4ea0be
jmp 0x4ea00e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x4ea0cc
add edi, ecx
jmp 0x4ea00e
pop esi
mov edi, esi
mov ecx, 4
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x4ea0ea
cmp byte [edi], 0
jne 0x4ea0ea
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x4ea0ef
mov ebp, dword [esi + 0xf8b74]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x19f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x4ea14a
sub esp, 0xffffff80
jmp 0x407c28
Function at 0x520e25
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00520ca4

Function at 0x525164
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00524e24
Function at 0x401123
Capabilities:
Create thread

Disassembly:
push ebx
push ebp
push esi
push edi
push dword [esp + 0x14]
lea eax, [esp + 0x18]
mov edi, ecx
push eax
call fcn.0040117e
xor ebp, ebp
pop ecx
pop ecx
mov ebx, dword [eax]
mov dword [eax], ebp
cmp dword [esp + 0x14], ebp
je 0x401152
push 4
push dword [esp + 0x18]
call fcn.004021ef
pop ecx
pop ecx
lea esi, [edi + 4]
push esi
push ebp
push ebx
push 0x401107
push ebp
push ebp
call fcn.004073c7
add esp, 0x18
mov dword [edi], eax
test eax, eax
je 0x401174
pop edi
pop esi
pop ebp
pop ebx
ret 4
push 6
mov dword [esi], ebp
call fcn.00401f1c
int3

Function at 0x40157f
Capabilities:
Encode data using xor

Disassembly:
push ebp
xor ebp, ebp
push esi
mov esi, ebp
cmp dword [esp + 0x10], esi
jbe 0x4016ad
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_InitializeAcl]
push edi
mov edi, dword [esp + 0x14]
push ebp
push ebp
push ebp
call ebx
xor byte [esi + edi], 0x38
push ebp
push ebp
push ebp
call ebx
add byte [esi + edi], 0xa
push ebp
push ebp
push ebp
call ebx
add byte [esi + edi], 0xb1
push ebp
push ebp
push ebp
call ebx
xor byte [esi + edi], 0x43
push ebp
push ebp
push ebp
call ebx
add byte [esi + edi], 0xac
push ebp
push ebp
push ebp
call ebx
add byte [esi + edi], 0x35
push ebp
push ebp
push ebp
call ebx
xor byte [esi + edi], 0x10
push ebp
push ebp
push ebp
call ebx
add byte [esi + edi], 0x82
push ebp
push ebp
push ebp
call ebx
add byte [esi + edi], 0xd2
push ebp
push ebp
push ebp
call ebx
xor byte [esi + edi], 0x82
push ebp
push ebp
push ebp
call ebx
add byte [esi + edi], 0xe4
push ebp
push ebp
push ebp
call ebx
add byte [esi + edi], 0x29
push ebp
push ebp
push ebp
call ebx
add byte [esi + edi], 0x6d
push ebp
push ebp
push ebp
call ebx
xor byte [esi + edi], 0x1b
push ebp
push ebp
push ebp
call ebx
xor byte [esi + edi], 0x83
push ebp
push ebp
push ebp
call ebx
add byte [esi + edi], 0x41
push ebp
push ebp
push ebp
call ebx
add byte [esi + edi], 0x10
push ebp
push ebp
push ebp
call ebx
add byte [esi + edi], 0x72
push ebp
push ebp
push ebp
call ebx
add byte [esi + edi], 0x2d
push ebp
push ebp
push ebp
call ebx
xor byte [esi + edi], 0xc2
push ebp
push ebp
push ebp
call ebx
add byte [esi + edi], 0x4a
push ebp
push ebp
push ebp
call ebx
add byte [esi + edi], 0xf2
push ebp
push ebp
push ebp
call ebx
add byte [esi + edi], 0x90
push ebp
push ebp
push ebp
call ebx
add byte [esi + edi], 0x1b
push ebp
push ebp
push ebp
call ebx
add byte [esi + edi], 0x4c
push ebp
push ebp
push ebp
call ebx
add byte [esi + edi], 0x18
push ebp
push ebp
push ebp
call ebx
xor byte [esi + edi], 0xcd
push ebp
push ebp
push ebp
call ebx
add byte [esi + edi], 0xb9
push ebp
push ebp
push ebp
call ebx
add byte [esi + edi], 0xb0
inc esi
cmp esi, dword [esp + 0x18]
jb 0x40159b
pop edi
pop ebx
pop esi
pop ebp
ret