joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40c730
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x9000]
push edi
or ebp, 0xffffffff
jmp 0x40c752
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x40c759
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x40c748
mov eax, 1
add ebx, ebx
jne 0x40c76b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x40c760
jne 0x40c77c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x40c760
xor ecx, ecx
sub eax, 3
jb 0x40c790
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x40c802
mov ebp, eax
add ebx, ebx
jne 0x40c79b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x40c7a8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x40c7cc
inc ecx
add ebx, ebx
jne 0x40c7b8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x40c7ad
jne 0x40c7c9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x40c7ad
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x40c7ec
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x40c7dd
jmp 0x40c74e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x40c7ec
add edi, ecx
jmp 0x40c74e
pop esi
mov edi, esi
mov ecx, 0xb4
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x40c80a
cmp byte [edi], 3
jne 0x40c80a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x40c80f
lea edi, [esi + 0xa000]
mov eax, dword [edi]
or eax, eax
je 0x40c87e
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xf2d4]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xf340]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x40c83c
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xf348]
or eax, eax
je 0x40c878
mov dword [ebx], eax
add ebx, 4
jmp 0x40c859
call dword [esi + 0xf344]
mov ebp, dword [esi + 0xf34c]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1f7]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x40c8b2
sub esp, 0xffffff80
jmp 0x401010
Function at 0x434dd0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x27000]
push edi
jmp 0x434dea
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x434df1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x434de0
mov eax, 1
add ebx, ebx
jne 0x434e03
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x434df8
jne 0x434e14
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x434df8
xor ecx, ecx
sub eax, 3
jb 0x434e28
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x434e9a
mov ebp, eax
add ebx, ebx
jne 0x434e33
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x434e40
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x434e64
inc ecx
add ebx, ebx
jne 0x434e50
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x434e45
jne 0x434e61
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x434e45
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x434e84
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x434e75
jmp 0x434de6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x434e84
add edi, ecx
jmp 0x434de6
pop esi
mov edi, esi
mov ecx, 0xc3c
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x434ea2
cmp byte [edi], 9
jne 0x434ea2
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x434ea7
lea edi, [esi + 0x32000]
mov eax, dword [edi]
or eax, eax
je 0x434f1f
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x450a4]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x4511c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x434ed4
mov ecx, edi
jns 0x434f03
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x45124]
or eax, eax
je 0x434f19
mov dword [ebx], eax
add ebx, 4
jmp 0x434ef1
call dword [esi + 0x45120]
mov ebp, dword [esi + 0x45128]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x217]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x434f53
sub esp, 0xffffff80
jmp 0x41373c
Function at 0x401400
Capabilities:
Get common file path
Get startup folder

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [esp + 0x10], 0x441030
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0x23
mov dword [esp], 0
call sub.SHELL32.DLL_SHGetFolderPathA
sub esp, 0x14
call sub.msvcrt.dll_rand
mov edx, eax
mov eax, edx
sar eax, 0x1f
shr eax, 0x1f
lea eax, [edx + eax]
sar eax, 1
add eax, eax
sub edx, eax
mov eax, edx
add eax, 5
mov dword [esp], eax
call sym._G4np_5IKD5rG_4D__955__5ROyq_VOy__5_5_VxK_QbOyK_U
mov dword [esp + 4], 0x43e005
mov dword [esp], 0x441030
call sub.msvcrt.dll_strcat
mov dword [esp + 4], 0x43d000
mov dword [esp], 0x441030
call sub.msvcrt.dll_strcat
leave
ret

Function at 0x4015c0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [esp + 0x14], 1
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov eax, dword [ebp + 8]
mov dword [esp + 8], eax
mov dword [esp + 4], str.open
mov dword [esp], 0
call sub.SHELL32.DLL_ShellExecuteA
sub esp, 0x18
leave
ret
Function at 0x401d36
Capabilities:
Create directory
Get common file path
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x28c
mov dword [ebp - 0x23c], sym._r
mov dword [ebp - 0x238], 0x43c046
lea eax, [ebp - 0x234]
lea edx, [ebp - 0x18]
mov dword [eax], edx
mov edx, 0x401f6a
mov dword [eax + 4], edx
mov dword [eax + 8], esp
lea eax, [ebp - 0x254]
mov dword [esp], eax
call fcn.0040d0f0
add dword [0x441018], 0xfffffff9
adc dword [0x44101c], 0xffffffff
mov dword [esp + 0x10], 0x4410b0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0x23
mov dword [esp], 0
mov dword [ebp - 0x250], 0xffffffff
call sub.SHELL32.DLL_SHGetFolderPathA
sub esp, 0x14
mov dword [esp + 4], 0x43e005
mov dword [esp], 0x4410b0
call sub.msvcrt.dll_strcat
mov dword [esp + 4], str.Saaaalamm
mov dword [esp], 0x4410b0
call sub.msvcrt.dll_strcat
mov dword [esp + 4], 0
mov dword [esp], 0x4410b0
call sub.KERNEL32.DLL_CreateDirectoryA
sub esp, 8
mov dword [esp + 4], str.Mira.h
mov dword [esp], 0x4410b0
call sub.msvcrt.dll_strcat
mov dword [esp + 4], 0x10
mov dword [esp], 4
call sym.QbOyK_U4OtJ_5ZxK_m5K_ir_l_Y_9MJm_T4V__5GQ4.4cq0Or4NxKn_5Ga4
mov dword [esp + 8], eax
mov dword [esp + 4], 0x4410b0
lea eax, [ebp - 0x118]
mov dword [esp], eax
call sym.Kl_D5CDv55_t0X15GMl_D5C4K5_h5
mov dword [esp + 4], 8
mov dword [esp], 4
call sym.QbOyK_U4OtJ_5ZxK_m5K_ir_l_Y_9MJm_T4V__5GQ4.4cq0Or4NxKn_5Ga4
mov dword [esp + 8], eax
mov dword [esp + 4], 0x43d040
lea eax, [ebp - 0x218]
mov dword [esp], eax
mov dword [ebp - 0x250], 2
call sym.Kl_D5CDv55_t0X15GMl_D5C4K5_h5
mov dword [ebp - 0x220], 0
mov dword [ebp - 0x21c], 0
mov eax, dword [ebp - 0x220]
mov edx, dword [ebp - 0x21c]
mov dword [ebp - 0x260], eax
mov dword [ebp - 0x25c], edx
mov edx, dword [ebp - 0x25c]
cmp edx, dword [0x44101c]
jg 0x401f2b
mov eax, dword [ebp - 0x25c]
cmp eax, dword [0x44101c]
jl 0x401ed0
mov edx, dword [ebp - 0x260]
cmp edx, dword [0x441018]
jae 0x401f2b
mov dword [esp + 8], 1
mov dword [esp + 4], 0x441020
lea eax, [ebp - 0x218]
mov dword [esp], eax
mov dword [ebp - 0x250], 1
call sym.55Z4_5R55Z4_5R55Z4_5R55Z4_5R55Z4_5R55Z4_5R55Z4_5R55Z4_5
mov dword [esp + 8], 1
mov dword [esp + 4], 0x441020
lea eax, [ebp - 0x118]
add eax, 8
mov dword [esp], eax
call sym.hBE7O6yOE7rE9DxO_9_47DZA5Ih565y5O3C4j8
lea eax, [ebp - 0x220]
add dword [eax], 1
adc dword [eax + 4], 0
jmp 0x401e8e
lea eax, [ebp - 0x218]
mov dword [esp], eax
mov dword [ebp - 0x250], 1
call sym.t05KY5K_X1MEYM_YEAZ554_t015G7MlY_545Kl_
lea eax, [ebp - 0x118]
mov dword [esp], eax
call sym.t05KY5K_X1MEYM_YEAZ554_t015G7MlY_545Kl_
mov dword [esp + 4], 2
mov dword [esp], 0x4410b0
call sub.KERNEL32.DLL_SetFileAttributesA
sub esp, 8
jmp 0x401fb6
lea eax, [ebp - 0x218]
mov dword [esp], eax
mov dword [ebp - 0x250], 2
call sym.RyR_EUitK_Kf1Q555KAoK.5tM___litMf1Fz5
jmp 0x402018
lea eax, [ebp - 0x118]
mov dword [esp], eax
mov dword [ebp - 0x250], 0xffffffff
call sym.RyR_EUitK_Kf1Q555KAoK.5tM___litMf1Fz5
lea eax, [ebp - 0x254]
mov dword [esp], eax
call fcn.0040d1d0
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x4040a0
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
call dword [sym.imp.KERNEL32.DLL_TlsAlloc]
cmp eax, 0xffffffff
je 0x4040d6
mov dword [0x4451d0], eax
mov edx, sym._Oz5_z5z5vK_YP4KY9k6p4tzMurp4X4M_tu0.4KY
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.0040cb80
test eax, eax
sete al
movzx eax, al
mov dword [0x43d0f0], eax
leave
ret
call dword [sym.imp.KERNEL32.DLL_GetLastError]
test eax, eax
sete al
movzx eax, al
mov dword [0x43d0f0], eax
leave
ret

Function at 0x4041c0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
lea eax, [ebp - 0xc]
sub esp, 0x68
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x40]
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], esi
mov dword [ebp - 4], edi
mov dword [ebp - 0x28], sym._r
mov dword [ebp - 0x24], 0x43c6d4
mov dword [ebp - 0x1c], 0x404280
mov dword [ebp - 0x18], esp
mov dword [esp], eax
call fcn.0040d0f0
cmp dword [0x43d0f0], 0
mov dword [ebp - 0x44], 0x4451e0
je 0x404260
jl 0x4042a0
mov dword [ebp - 0x3c], 1
mov eax, dword [0x4451d0]
mov dword [ebp - 0x4c], eax
mov eax, dword [sym.imp.KERNEL32.DLL_GetLastError]
call eax
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x4c]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.DLL_TlsGetValue]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x50]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.DLL_SetLastError]
mov eax, dword [ebp - 0x54]
sub esp, 4
test eax, eax
mov dword [ebp - 0x48], eax
je 0x404343
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x44], eax
lea esi, [esi]
lea eax, [ebp - 0x40]
mov dword [esp], eax
call fcn.0040d1d0
mov eax, dword [ebp - 0x44]
mov ebx, dword [ebp - 0xc]
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
mov edx, dword [0x4457f0]
mov eax, 0xffffffff
test edx, edx
je 0x4042ba
mov eax, dword [0x43d0f4]
test eax, eax
je 0x4042fa
xor eax, eax
test eax, eax
jne 0x4042f0
mov edi, dword [0x43d0f0]
test edi, edi
js 0x4042f0
mov dword [ebp - 0x44], 0x4451e0
mov ebx, dword [0x43d0f0]
test ebx, ebx
je 0x404260
jmp 0x40420e
xor esi, esi
mov dword [0x43d0f0], esi
jmp 0x4042c8
mov dword [esp], 0x43d0f8
mov dword [ebp - 0x3c], 1
call sub.KERNEL32.DLL_InterlockedIncrement
sub esp, 4
test eax, eax
je 0x404381
mov eax, dword [0x43d0f4]
test eax, eax
jne 0x4042b8
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.DLL_Sleep]
mov dword [ebp - 0x3c], 1
call eax
sub esp, 4
mov eax, dword [0x43d0f4]
test eax, eax
je 0x40431d
jmp 0x4042b8
mov dword [esp], 8
call sub.msvcrt.dll_malloc
mov dword [ebp - 0x48], eax
test eax, eax
je 0x404375
mov dword [esp + 4], eax
mov eax, dword [0x4451d0]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.DLL_TlsSetValue]
sub esp, 8
xor edx, edx
test eax, eax
je 0x4043aa
test edx, edx
je 0x404395
mov dword [ebp - 0x3c], 1
call sym.Mnmn48__4vKUantwAEx9rwVO445M_A44MnUL4ln5
call sym.5z5vK_YP4KY9k6p4tzMurp4X4M_tu0.4KYQj44M_tu0.
mov eax, 1
mov dword [0x43d0f4], eax
jmp 0x4042b8
mov eax, dword [ebp - 0x48]
mov dword [eax], 0
mov dword [eax + 4], 0
jmp 0x404256
call dword [sym.imp.KERNEL32.DLL_GetLastError]
mov edx, eax
jmp 0x404371
Function at 0x4099f0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x1c
mov eax, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
mov esi, dword [ebp + 0x10]
mov dword [ebp - 0x10], eax
lea esi, [esi]
lea edi, [edi]
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sym.IDw4M_DDd58F6tzGDW4.5K4Mvm9Qtu
mov dword [esp], eax
mov dword [esp + 8], esi
mov dword [esp + 4], edi
call sub.msvcrt.dll__read
cmp eax, 0xffffffff
mov ebx, eax
jne 0x409a3c
call sub.msvcrt.dll__errno
cmp dword [eax], 4
je 0x409a10
add esp, 0x1c
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x40ca20
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov eax, 0x10
mov ebp, esp
push ebx
sub esp, 0x64
and esp, 0xfffffff0
call fcn.0040db40
call fcn.0040cc80
call sub.KERNEL32.DLL_GetCommandLineA
mov ebx, eax
lea eax, [ebp - 0x58]
mov dword [esp], eax
call sub.KERNEL32.DLL_GetStartupInfoA
sub esp, 4
test ebx, ebx
jne 0x40ca58
jmp 0x40caf6
inc ebx
movzx ecx, byte [ebx]
cmp cl, 0x20
sete al
cmp cl, 9
sete dl
or eax, edx
test al, 1
jne 0x40ca57
cmp cl, 0x22
je 0x40cab0
cmp cl, 0x20
setne al
xor edx, edx
cmp cl, 9
setne dl
test eax, edx
je 0x40cad0
lea esi, [esi]
lea edi, [edi]
test cl, cl
je 0x40cad0
inc ebx
movzx ecx, byte [ebx]
cmp cl, 0x20
setne al
xor edx, edx
cmp cl, 9
setne dl
test eax, edx
jne 0x40ca90
jmp 0x40cad0
inc ebx
movzx ecx, byte [ebx]
cmp cl, 0x22
setne al
xor edx, edx
test cl, cl
setne dl
test eax, edx
jne 0x40cab0
cmp cl, 0x22
je 0x40cb32
lea esi, [esi]
cmp cl, 0x20
sete al
cmp cl, 9
sete dl
jmp 0x40caf0
inc ebx
movzx ecx, byte [ebx]
cmp cl, 0x20
sete dl
cmp cl, 9
sete al
or eax, edx
test al, 1
jne 0x40cae0
mov dword [esp], 0
call sub.KERNEL32.DLL_GetModuleHandleA
sub esp, 4
test byte [ebp - 0x2c], 1
mov edx, 0xa
je 0x40cb14
movzx edx, word [ebp - 0x28]
mov dword [esp + 8], ebx
xor ebx, ebx
mov dword [esp + 4], ebx
mov dword [esp + 0xc], edx
mov dword [esp], eax
call sym.5__5ROyq_VOy__5_5_VxK_QbOyK_U4OtJ_5ZxK_m5K_ir_l_Y_9MJm_T4V_
sub esp, 0x10
mov ebx, dword [ebp - 4]
leave
ret
inc ebx
movzx ecx, byte [ebx]
jmp 0x40cad0

Function at 0x40cfe0
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x14
mov ebx, dword [0x445850]
call dword [sym.imp.KERNEL32.DLL_TlsAlloc]
cmp eax, 0xffffffff
je 0x40d020
mov dword [ebx + 0x2c], eax
xor eax, eax
mov dword [esp + 4], eax
mov eax, dword [ebx + 0x2c]
mov dword [esp], eax
call fcn.0040cb80
test eax, eax
sete al
movzx eax, al
mov dword [ebx + 0x30], eax
add esp, 0x14
pop ebx
pop ebp
ret
call dword [sym.imp.KERNEL32.DLL_GetLastError]
test eax, eax
sete al
movzx eax, al
mov dword [ebx + 0x30], eax
add esp, 0x14
pop ebx
pop ebp
ret
Function at 0x1000e9b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
pushal
call 0x1000e9bf
pop dword [ebp - 0x2c]
mov eax, 0x3062b11
sub eax, 0xf3054152
sub dword [ebp - 0x2c], eax
mov dword [ebp - 0x3c], 0x99ae7db7
sub dword [ebp - 0x3c], 0x4b5c386c
mov dword [ebp - 0x38], 0x40dded87
sub dword [ebp - 0x38], 0xeaaa142
mov dword [ebp - 0x34], 0x7ca00fdc
add dword [ebp - 0x34], 0xcfac3452
mov dword [ebp - 0x30], 0x96fef1df
add dword [ebp - 0x30], 0x69010e21
lea eax, [ebp - 0x3c]
push eax
mov eax, sym.imp.kernel32.dll_LoadLibraryA
add eax, dword [ebp - 0x2c]
call dword [eax]
mov dword [ebp - 0x3c], 0xb9ca3b5
sub dword [ebp - 0x3c], 0x972a3a5f
mov dword [ebp - 0x38], 0xc1a68ffc
add dword [ebp - 0x38], 0x7fc5d179
mov dword [ebp - 0x34], 0x43b4d477
add dword [ebp - 0x34], 0x1fba97f5
mov dword [ebp - 0x30], 0x8529b687
sub dword [ebp - 0x30], 0x8529b687
lea ebx, [ebp - 0x3c]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x2c]
call dword [eax]
push 0x40
push 0x1000
push 0x357b5
push 0
call eax
mov ecx, 0xda96c4e0
add ecx, 0x25697ed0
mov edx, eax
mov edi, 0x32a2786e
add edi, 0xdd5faf92
add edi, dword [ebp - 0x2c]
mov esi, 0x1d2e6fe3
sub esi, 0x62a7d13c
sub dword [ebp - 0x14], 0xd2e4eb2a
mov ebx, dword [edi]
add dword [ebp - 0x20], 0xd06c8927
xor ebx, esi
mov dword [edx], ebx
mov dword [ebp - 4], 0xd3d94992
add edx, 0x31947e9a
sub edx, 0x31947e96
add edi, 4
loop 0x1000ead7
add eax, 0x9fcfbd8c
sub eax, 0x9fcebbf9
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x10000000
add ecx, dword [ebp - 0x2c]
call ebx
leave
ret

Function at 0x10014d90
Capabilities:
Terminate process

Disassembly:
mov eax, dword [0x1001f83c]
push dword [esp + 4]
mov eax, dword [eax]
push eax
mov ecx, dword [eax]
mov eax, dword [ecx + 0x234]
call eax
test eax, eax
je 0x10014dd2
push 0x51b
push str.hprof_util.c
push str.Unable_to_get_necessary_JVMTI_capabilities.
push 0
push 0
call fcn.10005090
add esp, 0x14
mov dword [esp + 4], 1
jmp fcn.10005080
ret

Function at 0x10016400
Capabilities:
Terminate process

Disassembly:
mov edx, dword [esp + 4]
xorps xmm0, xmm0
push edx
movups xmmword [edx], xmm0
mov eax, dword [0x1001f83c]
mov eax, dword [eax]
push eax
mov ecx, dword [eax]
mov eax, dword [ecx + 0x22c]
call eax
test eax, eax
je 0x10016449
push 0x50e
push str.hprof_util.c
push str.Unable_to_get_potential_JVMTI_capabilities.
push 0
push 0
call fcn.10005090
add esp, 0x14
mov dword [esp + 4], 1
jmp fcn.10005080
ret
Function at 0x4ef370
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0xcb000]
push edi
or ebp, 0xffffffff
jmp 0x4ef392
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x4ef399
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4ef388
mov eax, 1
add ebx, ebx
jne 0x4ef3ab
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x4ef3bc
jne 0x4ef3db
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4ef3db
dec eax
add ebx, ebx
jne 0x4ef3c8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x4ef3a0
add ebx, ebx
jne 0x4ef3d7
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x4ef42d
xor ecx, ecx
sub eax, 3
jb 0x4ef3f3
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x4ef462
sar eax, 1
mov ebp, eax
jmp 0x4ef3fe
add ebx, ebx
jne 0x4ef3fe
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4ef3cc
inc ecx
add ebx, ebx
jne 0x4ef40c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4ef3cc
add ebx, ebx
jne 0x4ef419
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x4ef40e
jne 0x4ef42a
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4ef40e
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x4ef44c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x4ef43e
jmp 0x4ef38e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x4ef44c
add edi, ecx
jmp 0x4ef38e
pop esi
mov edi, esi
mov ecx, 0xb17
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x4ef46a
cmp byte [edi], 9
jne 0x4ef46a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x4ef46f
lea edi, [esi + 0xed000]
mov eax, dword [edi]
or eax, eax
je 0x4ef4de
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xf210c]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xf2150]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x4ef49c
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xf2158]
or eax, eax
je 0x4ef4d8
mov dword [ebx], eax
add ebx, 4
jmp 0x4ef4b9
call dword [esi + 0xf2154]
mov ebp, dword [esi + 0xf215c]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1ff]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x4ef512
sub esp, 0xffffff80
jmp 0x40b8f0
Function at 0x2a8563c2
Capabilities:
Check if file exists

Disassembly:
push 0x64
mov eax, 0x2a982cdf
call fcn.2a84a73f
mov ebx, ecx
cmp dword [ebx + 4], 0xffffffff
jne 0x2a856503
push 0xffffffffffffffff
lea edi, [ebx + 0xc]
push 0x2a98b17c
mov ecx, edi
call fcn.2a8844ac
mov eax, dword [ebx]
push 0
push 0xffffffffffffffff
mov esi, dword [eax + 0x10]
mov ecx, esi
call dword [0x2a9884bc]
mov ecx, ebx
call esi
push eax
lea ecx, [ebp - 0x54]
call fcn.2a84a6ed
and dword [ebp - 4], 0
lea eax, [ebp - 0x54]
push eax
mov ecx, edi
call fcn.2a8c938e
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x44]
call fcn.2a84cb09
lea ecx, [ebp - 0x4c]
call fcn.2a84cb2b
push edi
lea ecx, [ebp - 0x3c]
call fcn.2a851f08
lea ecx, [ebp - 0x3c]
mov dword [ebp - 4], 1
call fcn.2a8c9bbe
lea eax, [ebp - 0x24]
mov dword [ebp - 4], 2
push eax
call fcn.2a8ca4aa
mov esi, eax
mov dword [ebp - 0x18], vtable.RSSecurityUtilsWin::CLocalFreeGuard.0
pop ecx
mov dword [ebp - 0x14], esi
mov ecx, dword [ebx + 8]
xor edi, edi
mov byte [ebp - 4], 3
cmp dword [ecx], edi
jne 0x2a8564c8
lea ecx, [ebp - 0x3c]
call fcn.2a8c9bbe
push edi
push 0x40110000
push 3
lea ecx, [ebp - 0x24]
push ecx
push edi
push 0xc0000000
push eax
call dword [sym.imp.kernel32.dll_CreateFileA]
mov dword [ebx + 4], eax
cmp eax, 0xffffffff
jne 0x2a8564c8
call dword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 2
je 0x2a85651f
cmp eax, 0xe7
jne 0x2a856509
lea ecx, [ebp - 0x3c]
call fcn.2a8c9bbe
push 0x4e20
push eax
call dword [sym.imp.kernel32.dll_WaitNamedPipeA]
test eax, eax
je 0x2a85652e
mov eax, dword [ebx + 8]
cmp dword [eax], edi
je 0x2a85646e
cmp dword [ebx + 4], 0xffffffff
je 0x2a8564e4
push edi
push edi
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 2
push eax
push dword [ebx + 4]
call dword [sym.imp.kernel32.dll_SetNamedPipeHandleState]
mov byte [ebp - 4], 6
test esi, esi
je 0x2a8564f3
push esi
call dword [sym.imp.kernel32.dll_LocalFree]
lea ecx, [ebp - 0x2c]
call fcn.2a84cb09
lea ecx, [ebp - 0x34]
call fcn.2a84cb2b
call fcn.2a84aa52
ret
push edi
push 0xffffffffffffffff
push str.Problem_Opening_channel
lea ecx, [ebp - 0x54]
call fcn.2a84a6ed
mov byte [ebp - 4], 4
jmp 0x2a856542
lea ecx, [ebp - 0x70]
call fcn.2a85615f
push 0x2a9f0450
jmp 0x2a856553
push edi
push 0xffffffffffffffff
push str.Problem_Opening_channel__all_pipe_instances_are_busy
lea ecx, [ebp - 0x54]
call fcn.2a84a6ed
mov byte [ebp - 4], 5
lea eax, [ebp - 0x54]
push eax
lea ecx, [ebp - 0x70]
call fcn.2a8844ac
push 0x2a9f04a8
lea eax, [ebp - 0x70]
push eax
call sub.VCRUNTIME140.dll__CxxThrowException
int3