joyce8/EMBER2024-capa huggingface dataset:
Function at 0x47ab42
Capabilities:
Check mutex on windows

Disassembly:
push 0x6c
mov eax, 0x4944ea
call fcn.00427e31
mov eax, dword [0x4e77a8]
shr eax, 0xe
test al, 1
je 0x47acb8
xor ebx, ebx
lea ecx, [ebp - 0x58]
push 0x4e7698
mov dword [ebp - 0x58], ebx
mov dword [ebp - 0x48], ebx
mov dword [ebp - 0x44], ebx
call fcn.00405ca7
push 7
mov dword [ebp - 4], ebx
lea ecx, [ebp - 0x40]
pop esi
xor eax, eax
mov dword [ebp - 0x40], ebx
push 0x4ab868
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x2c], esi
mov word [ebp - 0x40], ax
call fcn.00402048
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x28]
xor eax, eax
mov dword [ebp - 0x28], ebx
push 0x4ab830
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], esi
mov word [ebp - 0x28], ax
call fcn.00402048
lea eax, [ebp - 0x40]
mov byte [ebp - 4], 2
push eax
lea edx, [ebp - 0x28]
lea ecx, [ebp - 0x58]
call fcn.0040a6d4
mov eax, dword [ebp - 0x14]
mov edi, 0x1000
pop ecx
push 8
pop esi
cmp eax, esi
jb 0x47ac0d
mov ecx, dword [ebp - 0x28]
lea eax, [eax*2 + 2]
mov dword [ebp - 0x74], eax
mov dword [ebp - 0x78], ecx
cmp eax, edi
jb 0x47ac04
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0x78]
push eax
call fcn.004016dc
mov eax, dword [ebp - 0x74]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x78]
push eax
push ecx
call fcn.004272f3
pop ecx
pop ecx
xor eax, eax
mov byte [ebp - 4], bl
mov word [ebp - 0x28], ax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], 7
cmp eax, esi
jb 0x47ac59
mov ecx, dword [ebp - 0x40]
lea eax, [eax*2 + 2]
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x74], ecx
cmp eax, edi
jb 0x47ac50
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp - 0x74]
push eax
call fcn.004016dc
mov eax, dword [ebp - 0x78]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x74]
push eax
push ecx
call fcn.004272f3
pop ecx
pop ecx
cmp dword [ebp - 0x44], esi
lea eax, [ebp - 0x58]
cmovae eax, dword [ebp - 0x58]
push eax
push 1
push ebx
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [0x4e7a04], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x47acbe
mov eax, dword [ebp - 0x44]
cmp eax, esi
jb 0x47acb8
mov ecx, dword [ebp - 0x58]
lea eax, [eax*2 + 2]
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x74], ecx
cmp eax, edi
jb 0x47acaf
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp - 0x74]
push eax
call fcn.004016dc
mov eax, dword [ebp - 0x78]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x74]
push eax
push ecx
call fcn.004272f3
pop ecx
pop ecx
call fcn.00427de0
ret
push 0x2e
push 0x29
lea eax, [ebp - 0x70]
push eax
call fcn.00479c27
lea ecx, [ebp - 0x70]
mov byte [ebp - 4], 3
call fcn.00480d51
lea eax, [ebp - 0x70]
push eax
lea ecx, [ebp - 0x38]
call fcn.00405c31
lea eax, [ebp - 0x38]
mov byte [ebp - 4], 4
push eax
lea ecx, [ebp - 0x20]
call fcn.00405055
push 0x4b8c3c
lea eax, [ebp - 0x20]
push eax
call fcn.0042a85e
int3
Function at 0x47ad26
Capabilities:
Write file on windows

Disassembly:
push 0x3c
mov eax, 0x49452e
call fcn.00427e31
xor ebx, ebx
mov dword [ebp - 0x2c], 0xf
mov dword [ebp - 0x40], ebx
mov dword [ebp - 0x30], ebx
mov byte [ebp - 0x40], bl
lea eax, [ebp - 0x40]
mov dword [ebp - 4], ebx
push eax
movzx eax, byte [ebp + 8]
add eax, 0x405
push eax
call fcn.0047b380
cmp dword [ebp - 0x30], 0xa
mov edi, 0x1000
jbe 0x47aeb9
mov esi, 0x4e76b0
cmp dword [0x4e76c0], ebx
je 0x47ad81
mov ecx, esi
call fcn.00408a61
test al, al
jne 0x47ad99
lea ecx, [ebp - 0x28]
call fcn.0040907b
push eax
mov ecx, esi
call fcn.00401a02
lea ecx, [ebp - 0x28]
call fcn.0040172c
push 0x4ab830
mov edx, esi
lea ecx, [ebp - 0x28]
call fcn.00401a90
pop ecx
mov esi, 0x4e76fc
push eax
mov ecx, esi
call fcn.00401a02
lea ecx, [ebp - 0x28]
call fcn.0040172c
cmp byte [ebp + 8], 0
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ebx
je 0x47ae1c
push 0x4e78ec
call fcn.00405ca7
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 1
push eax
mov ecx, esi
call fcn.00401a47
mov eax, dword [ebp - 0x14]
cmp eax, 8
jb 0x47ae6f
mov ecx, dword [ebp - 0x28]
lea eax, [eax*2 + 2]
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x48], ecx
cmp eax, edi
jb 0x47ae66
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0x48]
push eax
call fcn.004016dc
mov eax, dword [ebp - 0x44]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x48]
jmp 0x47ae66
push 0x4e78d4
call fcn.00405ca7
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 2
push eax
mov ecx, esi
call fcn.00401a47
mov eax, dword [ebp - 0x14]
cmp eax, 8
jb 0x47ae6f
mov ecx, dword [ebp - 0x28]
lea eax, [eax*2 + 2]
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x44], ecx
cmp eax, edi
jb 0x47ae66
lea eax, [ebp - 0x48]
push eax
lea eax, [ebp - 0x44]
push eax
call fcn.004016dc
mov eax, dword [ebp - 0x48]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x44]
push eax
push ecx
call fcn.004272f3
pop ecx
pop ecx
cmp dword [0x4e7710], 8
push 0x4ab84c
cmovae esi, dword [0x4e76fc]
push esi
call fcn.00437e2b
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x47aeb9
cmp dword [ebp - 0x2c], 0x10
lea ecx, [ebp - 0x40]
push esi
cmovae ecx, dword [ebp - 0x40]
push 1
push dword [ebp - 0x30]
push ecx
call fcn.00437a87
dec eax
neg eax
push esi
sbb al, al
inc al
mov bl, al
call fcn.0043751a
add esp, 0x14
mov eax, dword [ebp - 0x2c]
cmp eax, 0x10
jb 0x47aeed
mov ecx, dword [ebp - 0x40]
inc eax
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x44], ecx
cmp eax, edi
jb 0x47aee4
lea eax, [ebp - 0x48]
push eax
lea eax, [ebp - 0x44]
push eax
call fcn.004016dc
mov eax, dword [ebp - 0x48]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x44]
push eax
push ecx
call fcn.004272f3
pop ecx
pop ecx
mov al, bl
call fcn.00427de0
ret 4
Function at 0x47aef7
Capabilities:
Write file on windows

Disassembly:
push 0x24
mov eax, 0x494562
call fcn.00427e31
xor ebx, ebx
mov dword [ebp - 0x14], 0xf
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x18], ebx
mov byte [ebp - 0x28], bl
lea eax, [ebp - 0x28]
mov dword [ebp - 4], ebx
push eax
movzx eax, byte [ebp + 8]
lea eax, [eax*2 + 0x401]
push eax
call fcn.0047b380
cmp dword [ebp - 0x18], 0xa
jbe 0x47af66
call fcn.0047b3e9
mov esi, eax
test esi, esi
je 0x47af66
cmp dword [ebp - 0x14], 0x10
lea eax, [ebp - 0x28]
push esi
cmovae eax, dword [ebp - 0x28]
push 1
push dword [ebp - 0x18]
push eax
call fcn.00437a87
dec eax
neg eax
push esi
sbb al, al
lea ebx, [eax + 1]
call fcn.0043751a
add esp, 0x14
mov eax, dword [ebp - 0x14]
cmp eax, 0x10
jb 0x47af9d
mov ecx, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x30], ecx
cmp eax, 0x1000
jb 0x47af94
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x30]
push eax
call fcn.004016dc
mov eax, dword [ebp - 0x2c]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x30]
push eax
push ecx
call fcn.004272f3
pop ecx
pop ecx
mov al, bl
call fcn.00427de0
ret 4

Function at 0x47afa7
Capabilities:
Write file on windows

Disassembly:
push 0x24
mov eax, 0x494596
call fcn.00427e31
xor ebx, ebx
mov dword [ebp - 0x14], 0xf
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x18], ebx
mov byte [ebp - 0x28], bl
lea eax, [ebp - 0x28]
mov dword [ebp - 4], ebx
push eax
push 0x3fa
call fcn.0047b380
call fcn.0047b048
mov esi, eax
test esi, esi
je 0x47b009
cmp dword [ebp - 0x14], 0x10
lea eax, [ebp - 0x28]
push esi
cmovae eax, dword [ebp - 0x28]
push 1
push dword [ebp - 0x18]
push eax
call fcn.00437a87
dec eax
neg eax
push esi
sbb al, al
lea ebx, [eax + 1]
call fcn.0043751a
add esp, 0x14
mov eax, dword [ebp - 0x14]
cmp eax, 0x10
jb 0x47b040
mov ecx, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x30], ecx
cmp eax, 0x1000
jb 0x47b037
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x30]
push eax
call fcn.004016dc
mov eax, dword [ebp - 0x2c]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x30]
push eax
push ecx
call fcn.004272f3
pop ecx
pop ecx
mov al, bl
call fcn.00427de0
ret
Function at 0x47b0c0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x4e77a8]
shr eax, 0x11
mov dword [ebp - 4], 1
push esi
push edi
test al, 1
je 0x47b0ef
cmp dword [0x4e7a74], 0
je 0x47b0ef
mov esi, 0x4e7a64
push esi
call fcn.0047b3a2
jmp 0x47b119
and dword [0x4e7a74], 0
mov esi, 0x4e7a64
cmp dword [0x4e7a78], 0x10
mov eax, esi
push esi
cmovae eax, dword [0x4e7a64]
push 0x3fc
mov byte [eax], 0
call fcn.0047b380
call fcn.0047b49b
mov edi, eax
test edi, edi
je 0x47b17a
mov edx, dword [0x4e7a78]
mov eax, esi
cmp edx, 0x10
cmovae eax, dword [0x4e7a64]
mov eax, dword [eax]
cmp eax, dword [0x4a4dd7]
jne 0x47b16e
mov eax, dword [0x4e7a74]
cmp edx, 0x10
mov ecx, esi
cmovae ecx, dword [0x4e7a64]
add eax, 0xfffffffc
push edi
push 1
push eax
lea eax, [ecx + 4]
push eax
call fcn.00437a87
add esp, 0x10
dec eax
neg eax
sbb al, al
inc al
mov byte [ebp - 4], al
push edi
call fcn.0043751a
mov eax, dword [ebp - 4]
pop ecx
jmp 0x47b17c
xor al, al
and dword [0x4e7a74], 0
cmp dword [0x4e7a78], 0x10
pop edi
cmovae esi, dword [0x4e7a64]
mov byte [esi], 0
pop esi
leave
ret

Function at 0x47b198
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x804
mov eax, dword [0x4bd034]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x4e76c0], 0
push esi
mov esi, 0x4e76b0
jne 0x47b2b3
push ebx
lea eax, [ebp - 0x804]
push eax
push 0x400
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea eax, [ebp - 0x804]
mov ecx, esi
push eax
call fcn.00402048
cmp dword [0x4e76c4], 8
mov eax, esi
cmovae eax, dword [0x4e76b0]
xor ebx, ebx
push ebx
push eax
call fcn.00436f23
pop ecx
pop ecx
test eax, eax
je 0x47b211
push 0x4a933c
mov ecx, esi
call fcn.00402048
mov ecx, esi
call fcn.00408eb8
cmp dword [0x4e76c0], ebx
je 0x47b236
cmp dword [0x4e76c4], 8
mov eax, esi
push ebx
cmovae eax, dword [0x4e76b0]
push eax
call fcn.00436f23
pop ecx
pop ecx
test eax, eax
je 0x47b249
push str.TEMP
call fcn.00437d5f
pop ecx
push eax
mov ecx, esi
call fcn.00402048
cmp dword [0x4e76c0], ebx
je 0x47b26e
cmp dword [0x4e76c4], 8
mov eax, esi
push ebx
cmovae eax, dword [0x4e76b0]
push eax
call fcn.00436f23
pop ecx
pop ecx
test eax, eax
je 0x47b281
push 0x4ab860
call fcn.00437d5f
pop ecx
push eax
mov ecx, esi
call fcn.00402048
cmp dword [0x4e76c0], ebx
je 0x47b2a6
cmp dword [0x4e76c4], 8
mov eax, esi
push ebx
cmovae eax, dword [0x4e76b0]
push eax
call fcn.00436f23
pop ecx
pop ecx
test eax, eax
je 0x47b2b2
push 0x4e7680
mov ecx, esi
call fcn.00405d0f
pop ebx
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.004272e5
leave
ret
Function at 0x4803d3
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x254
mov eax, dword [0x4bd034]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov ebx, ecx
cmp dword [esi + 0xc], 0x201
jne 0x4804c4
push edi
push 0x208
xor edi, edi
lea eax, [ebp - 0x20c]
push edi
push eax
call fcn.00429240
mov eax, dword [esi + 0x18]
add esp, 0xc
mov dword [ebp - 0x218], eax
mov eax, dword [esi + 0x1c]
mov dword [ebp - 0x214], eax
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x210], eax
lea eax, [ebp - 0x218]
push eax
push edi
push 0x44b
push dword [esi]
call dword [sym.imp.USER32.dll_SendMessageW]
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x250], edi
mov dword [ebp - 0x244], eax
xor eax, eax
push 7
mov dword [ebp - 0x24c], edi
mov dword [ebp - 0x248], edi
mov dword [ebp - 0x240], edi
mov dword [ebp - 0x23c], edi
lea edi, [ebp - 0x234]
pop ecx
mov dword [ebp - 0x254], 0x3c
mov dword [ebp - 0x238], 5
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x254]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
push dword [ebx + 0x44]
call dword [sym.imp.USER32.dll_HideCaret]
mov eax, dword [ebx + 0xb8]
pop edi
cmp eax, dword [ebx + 0xbc]
je 0x4804c7
mov eax, dword [eax]
push dword [eax]
call dword [sym.imp.USER32.dll_SetFocus]
jmp 0x4804c7
and dword [eax], 0
mov ecx, dword [ebp - 4]
xor eax, eax
pop esi
xor ecx, ebp
pop ebx
call fcn.004272e5
leave
ret 0xc

Function at 0x481030
Capabilities:
Log keystrokes via application hook

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
mov dword [0x4e7bf4], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push 0xfffffffffffffffa
push dword [0x4e7bf4]
mov esi, eax
call dword [sym.imp.USER32.dll_GetWindowLongW]
push esi
push eax
push 0x480d80
push 2
call dword [sym.imp.USER32.dll_SetWindowsHookExW]
test eax, eax
mov dword [0x4e7bf8], eax
pop esi
setne al
pop ebp
ret 4
Function at 0x48bc00
Capabilities:
Check if file exists
Get file attributes
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x40
push ebx
push esi
mov esi, ecx
mov dword [esp + 0xc], edx
xor bl, bl
mov eax, esi
cmp dword [esi + 0x14], 8
jb 0x48bc1d
mov eax, dword [esi]
test eax, eax
je 0x48bd41
cmp word [eax], 0
je 0x48bd41
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x48bd41
test al, 0x10
jne 0x48bd41
cmp dword [esi + 0x14], 8
jb 0x48bc4f
mov esi, dword [esi]
push 0x4ab888
push esi
call fcn.00437e2b
mov esi, eax
add esp, 8
test esi, esi
je 0x48bd41
lea eax, [esp + 0x18]
xorps xmm0, xmm0
push eax
push esi
movlpd qword [esp + 0x18], xmm0
call fcn.004397fb
push 2
push 0
push esi
call fcn.00438ecd
lea eax, [esp + 0x24]
push eax
push esi
call fcn.004397fb
lea eax, [esp + 0x34]
push eax
push esi
call fcn.00439c7c
add esp, 0x24
cmp dword [esp + 0x10], 0x28
jbe 0x48bd38
xor eax, eax
mov dword [esp + 0x20], 0x48535844
push esi
push 1
mov word [esp + 0x40], ax
xorps xmm0, xmm0
mov dword [esp + 0x44], eax
mov dword [esp + 0x48], eax
mov dword [esp + 0x4c], eax
lea eax, [esp + 0x28]
push 0x28
push eax
mov dword [esp + 0x34], 0x28
mov dword [esp + 0x38], 0
mov dword [esp + 0x3c], 0
movsd qword [esp + 0x40], xmm0
call fcn.00438514
add esp, 0x10
test eax, eax
je 0x48bd38
mov eax, dword [esp + 0x2c]
not eax
ror eax, 3
cmp eax, dword [esp + 0xc]
jne 0x48bd38
cmp dword [esp + 0x20], 0x48535844
jne 0x48bd38
cmp dword [esp + 0x24], 0x28
jne 0x48bd38
movzx ecx, word [esp + 0x38]
add ecx, dword [esp + 0x44]
mov eax, dword [esp + 0x3c]
add ecx, dword [esp + 0x40]
add eax, 0x28
add eax, ecx
cmp eax, dword [esp + 0x10]
sete bl
push esi
call fcn.0043751a
add esp, 4
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4afce4
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffb4
mov dword [esp], eax
lea esi, [esp + 0x30]
lea eax, [esp + 0xc]
push eax
call sub.kernel32.dll_GetSystemInfo
mov edi, dword [esp]
push 0x1c
push esi
push edi
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x4afdaf
jmp 0x4afda3
cmp dword [esi + 0x10], 0x1000
jne 0x4afd8f
test byte [esi + 0x15], 1
jne 0x4afd8f
mov byte [esp + 4], 0
mov ebp, dword [esi + 0x14]
cmp ebp, 1
je 0x4afd40
cmp ebp, 2
je 0x4afd40
cmp ebp, 0x10
je 0x4afd40
cmp ebp, 0x20
jne 0x4afd5c
lea eax, [esp + 8]
push eax
push 0x40
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x4afd5c
mov byte [esp + 4], 1
xor ebx, ebx
jmp 0x4afd6d
mov eax, dword [esi]
add eax, ebx
call fcn.004afcdc
add ebx, dword [esp + 0x10]
cmp ebx, dword [esi + 0xc]
jb 0x4afd60
cmp byte [esp + 4], 0
je 0x4afd8f
lea eax, [esp + 8]
push eax
mov eax, dword [esp + 0xc]
push eax
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
mov eax, dword [esi]
add eax, dword [esi + 0xc]
mov edi, eax
push 0x1c
push esi
push edi
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x4afdaf
mov eax, dword [esi + 4]
cmp eax, dword [esp]
je 0x4afd15
add esp, 0x4c
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x430006
Capabilities:
Encode data using xor

Disassembly:
mov eax, section..pdata
nop
mov ebx, 0x408f6c
nop
mov ecx, 0x1b312c71
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x43004e
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x430024
nop
nop
nop
nop
nop
mov eax, section..pdata_1
mov ebx, 0x42e3d0
nop
mov ecx, 0x144b15c3
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x430084
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x43006c
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x401219
Function at 0x4063a4
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x426d8c], 0
push esi
jne 0x4063db
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x4063b5
mov dword [ecx*4 + 0x426d88], eax
inc ecx
cmp ecx, 0x100
jl 0x4063b0
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x40640c
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x426d88]
xor eax, esi
inc ecx
dec edx
jne 0x4063ee
pop edi
not eax
pop esi
ret 0xc

Function at 0x41cee0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x1a000]
push edi
or ebp, 0xffffffff
jmp 0x41cf02
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x41cf09
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x41cef8
mov eax, 1
add ebx, ebx
jne 0x41cf1b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x41cf10
jne 0x41cf2c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x41cf10
xor ecx, ecx
sub eax, 3
jb 0x41cf40
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x41cfb2
mov ebp, eax
add ebx, ebx
jne 0x41cf4b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x41cf58
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x41cf7c
inc ecx
add ebx, ebx
jne 0x41cf68
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x41cf5d
jne 0x41cf79
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x41cf5d
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x41cf9c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x41cf8d
jmp 0x41cefe
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x41cf9c
add edi, ecx
jmp 0x41cefe
pop esi
mov edi, esi
mov ecx, 0x157
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x41cfba
cmp byte [edi], 0
jne 0x41cfba
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov eax, ebx
loop 0x41cfbf
lea edi, [esi + 0x1a000]
mov eax, dword [edi]
or eax, eax
je 0x41d02e
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x1d0b0]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x1d100]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x41cfec
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x1d104]
or eax, eax
je 0x41d028
mov dword [ebx], eax
add ebx, 4
jmp 0x41d009
call dword [esi + 0x1d108]
popal
jmp 0x403ab4
Function at 0x5520b0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0xea000]
push edi
or ebp, 0xffffffff
jmp 0x5520d2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x5520d9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x5520c8
mov eax, 1
add ebx, ebx
jne 0x5520eb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x5520fc
jne 0x55210c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x55210c
dec eax
add ebx, ebx
jne 0x552108
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x5520e0
xor ecx, ecx
sub eax, 3
jb 0x552124
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x552196
sar eax, 1
mov ebp, eax
jmp 0x55212f
add ebx, ebx
jne 0x55212f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x55213c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x552160
inc ecx
add ebx, ebx
jne 0x55214c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x552141
jne 0x55215d
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x552141
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x552180
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x552171
jmp 0x5520ce
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x552180
add edi, ecx
jmp 0x5520ce
pop esi
mov edi, esi
mov ecx, 0x5b17
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x55219e
cmp byte [edi], 0x13
jne 0x55219e
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov eax, ebx
loop 0x5521a3
lea edi, [esi + 0x14f000]
mov eax, dword [edi]
or eax, eax
je 0x55221b
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x158cec]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x158df0]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x5521d0
mov ecx, edi
jns 0x5521ff
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x158df4]
or eax, eax
je 0x552215
mov dword [ebx], eax
add ebx, 4
jmp 0x5521ed
call dword [esi + 0x158df8]
popal
jmp 0x47d0c7
Function at 0x406624
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x23c
push esi
mov esi, 0x104
lea eax, [ebp - 0x23c]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
cmp eax, esi
pop esi
jbe 0x406648
xor eax, eax
test eax, eax
je 0x40665b
cmp word [ebp + eax*2 - 0x23e], 0x5c
je 0x40665b
xor ecx, ecx
jmp 0x40665e
xor ecx, ecx
inc ecx
push dword [ebp + 8]
lea ecx, [ecx*2 + 0x40a014]
lea eax, [ebp + eax*2 - 0x23c]
push ecx
push str._s_S.dll
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea eax, [ebp - 0x23c]
push 8
push 0
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
leave
ret 4

Function at 0x406787
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x4318ec], 0
push esi
jne 0x4067be
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x406798
mov dword [ecx*4 + 0x4318e8], eax
inc ecx
cmp ecx, 0x100
jl 0x406793
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x4067ef
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x4318e8]
xor eax, esi
inc ecx
dec edx
jne 0x4067d1
pop edi
not eax
pop esi
ret 0xc

Function at 0x510024
Capabilities:
Packed with generic packer

Disassembly:
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [edx], al
add al, byte [eax]
add byte [eax], al
cld
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add al, byte [eax]
add byte [eax], al
cld
invalid
stc
jb 0x51002e
pop ds
xor esi, dword [ecx - 0x49]
jno 0x50ffe2
cwde
leave
jmp 0x51008f
pushal
jmp 0x510034
call 0x51003f
dec ecx
stc
mov dl, 0xed
pop ecx
pop ebx
jb 0x510049
jne 0x50ffd9
jge 0x510029
sbb dword [edx - 0x383c7edc], 0xffffffff
invalid
add ebx, 0xffffffc7
jmp 0x510058
cmp dword [ebx], 0
stc
jmp 0x510067
je 0x5100ed
jmp 0x510076
mov ecx, ebx
jmp 0x510081
add ebx, 4
jmp 0x510089
mov edx, dword [ebx]
jmp 0x510097
and eax, 0x8ced9cec
in eax, dx
cmp ebp, dword [ebx + 3]
sar ecx, cl
add edx, ebx
stc
jb 0x5100a3
mov ah, 0xb1
mov ebx, 0xc91a740d
mov eax, dword [ebx + 4]
jmp 0x5100ac
sub dword [edx], 0x3c62176a
jmp 0x5100b6
add edx, 4
jmp 0x5100bf
sub eax, 1
jmp 0x5100c6
jne 0x5100a6
jmp 0x5100d0
add ebx, 8
jmp 0x5100d7
sub dword [ecx], 1
stc
jb 0x5100de
and ecx, dword [edi]
test dword [eax + 0x72ffffff], esp
add dh, byte [ecx + 0xee83b]
add byte [eax], al
jne 0x510084
jb 0x5100e8
mov cl, 0x3b
call 0x5100fb
jmp 0x5100f1
popal
jmp 0x5100f6
jmp 0x50ed00