joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10068dc0
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x290
mov eax, dword [0x100db688]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x84]
push edi
push 0x80
push 0
push eax
call fcn.10081e40
push 0x80
lea eax, [ebp - 0x84]
push eax
push esi
call fcn.10068280
lea ecx, [ebp - 0x188]
mov edi, esi
mov eax, ecx
add esp, 0x18
mov edx, 0x104
sub edi, eax
lea eax, [edx + 0x7ffffefa]
test eax, eax
je 0x10068e2a
mov al, byte [edi + ecx]
test al, al
je 0x10068e2a
mov byte [ecx], al
inc ecx
sub edx, 1
jne 0x10068e11
lea eax, [ecx - 1]
test edx, edx
cmovne eax, ecx
mov ecx, 0x104
mov byte [eax], 0
lea eax, [ebp - 0x188]
cmp byte [eax], 0
je 0x10068e4b
inc eax
sub ecx, 1
jne 0x10068e40
mov edx, 0x104
mov edi, ecx
mov eax, edx
sub eax, ecx
neg edi
sbb edi, edi
and edi, eax
test ecx, ecx
je 0x10068ea0
lea ecx, [ebp - 0x188]
lea ecx, [ecx + edi]
sub edx, edi
je 0x10068e95
lea edi, [ebp - 0x84]
mov eax, SysReAllocString
sub edi, ecx
push ebx
nop dword [eax + eax]
test eax, eax
je 0x10068e94
mov bl, byte [edi + ecx]
test bl, bl
je 0x10068e94
mov byte [ecx], bl
dec eax
inc ecx
sub edx, 1
jne 0x10068e80
pop ebx
test edx, edx
lea eax, [ecx - 1]
cmovne eax, ecx
mov byte [eax], 0
push 0x100
lea eax, [ebp - 0x288]
mov dword [ebp - 0x290], 1
push 0
push eax
call fcn.10081e40
add esp, 0xc
mov dword [ebp - 0x28c], 0x100
lea eax, [ebp - 0x28c]
push eax
lea eax, [ebp - 0x288]
push eax
lea eax, [ebp - 0x290]
push eax
push 0x100be980
push str.SoftwareMaster2Liveup
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueA]
mov edi, dword [sym.imp.SHLWAPI.dll_SHSetValueA]
test eax, eax
jne 0x10068f5a
lea eax, [ebp - 0x288]
mov cl, byte [eax]
cmp cl, byte [esi]
jne 0x10068f24
test cl, cl
je 0x10068f20
mov cl, byte [eax + 1]
cmp cl, byte [esi + 1]
jne 0x10068f24
add eax, 2
add esi, 2
test cl, cl
jne 0x10068f04
xor eax, eax
jmp 0x10068f29
sbb eax, eax
or eax, 1
test eax, eax
je 0x10068f5a
lea ecx, [ebp - 0x288]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10068f36
sub ecx, edx
lea eax, [ebp - 0x288]
push ecx
push eax
push 1
push str.mid_old
push str.SoftwareMaster2Liveup
push reloc.OLEAUT32.dll_SysReAllocString
call edi
lea ecx, [ebp - 0x188]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10068f63
sub ecx, edx
lea eax, [ebp - 0x188]
push ecx
push eax
push 1
push 0x100be980
push str.SoftwareMaster2Liveup
push reloc.OLEAUT32.dll_SysReAllocString
call edi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.10061c7c
mov esp, ebp
pop ebp
ret
Function at 0x1006abe0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0
push dword [ebp + 8]
call fcn.1006ad10
add esp, 8
test al, al
je 0x1006ac05
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x1006ac05
mov al, 1
pop ebp
ret
xor al, al
pop ebp
ret

Function at 0x1006ad10
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
setne al
pop ebp
ret

Function at 0x1006b090
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
lea eax, [ebp - 4]
push eax
push dword [ecx]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, 0xffffffff
jne 0x1006b0bb
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x1006b0bb
xor al, al
pop esi
mov esp, ebp
pop ebp
ret 4
mov eax, dword [ebp + 8]
xor ecx, ecx
mov edx, dword [ebp - 4]
add ecx, esi
pop esi
adc edx, 0
mov dword [eax], ecx
mov dword [eax + 4], edx
mov al, 1
mov esp, ebp
pop ebp
ret 4

Function at 0x1006bfef
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret

Function at 0x100a069c
Capabilities:
Create thread
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.100a05a1

Function at 0x100a2914
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.100a25d4
Function at 0x40f080
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, 0x40b015
lea edi, [esi - 0xa015]
push edi
or ebp, 0xffffffff
jmp 0x40f0a2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x40f0a9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x40f098
mov eax, 1
add ebx, ebx
jne 0x40f0bb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x40f0b0
jne 0x40f0cc
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x40f0b0
xor ecx, ecx
sub eax, 3
jb 0x40f0e0
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x40f152
mov ebp, eax
add ebx, ebx
jne 0x40f0eb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x40f0f8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x40f11c
inc ecx
add ebx, ebx
jne 0x40f108
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x40f0fd
jne 0x40f119
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x40f0fd
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x40f13c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x40f12d
jmp 0x40f09e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x40f13c
add edi, ecx
jmp 0x40f09e
pop esi
mov edi, esi
mov ecx, 0x265
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x40f15a
cmp byte [edi], 2
jne 0x40f15a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov eax, ebx
loop 0x40f15f
lea edi, [esi + 0xd000]
mov eax, dword [edi]
or eax, eax
je 0x40f1ce
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xf000]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xf064]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x40f18c
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xf068]
or eax, eax
je 0x40f1c8
mov dword [ebx], eax
add ebx, 4
jmp 0x40f1a9
call dword [esi + 0xf06c]
popal
jmp 0x40354a

Function at 0x430004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
mov eax, section..data
mov ebx, 0x408ecc
nop
mov ecx, 0x1f5b77cc
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x43004e
nop
nop
nop
nop
xor dword [eax], ecx
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x430024
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x42e1d0
nop
nop
mov ecx, 0x1ad06d99
nop
nop
nop
test eax, eax
nop
je 0x430084
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
nop
jne 0x43006c
nop
popal
nop
nop
nop
nop
jmp 0x401219
Function at 0x431000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43100c
nop
nop
nop
nop
nop
pop eax
add eax, 0x403e6a
nop
nop
sub eax, 0x403e10
nop
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
jl 0x431030
nop
nop
nop
nop
nop
nop
nop
add eax, 0xc
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43101e
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp fcn.00401219

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x40404f
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x41a6a8
call fcn.00419c80
push ecx
push ebx
push esi
mov esi, ecx
push 4
mov dword [ebp - 0x10], esi
or dword [esi], 0xffffffff
lea ebx, [esi + 4]
mov ecx, ebx
call fcn.00403dc7
mov dword [ebx], 0x41d3b0
xor ebx, ebx
mov dword [esi + 0x28], 4
mov dword [ebp - 4], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x18], 0x41d3c8
lea ecx, [esi + 0x30]
mov byte [ebp - 4], 1
mov byte [esi + 0x2c], 1
call fcn.00404153
lea ecx, [esi + 0x80]
mov byte [esi + 0x7c], bl
push 0xf
mov byte [ebp - 4], 2
mov dword [ecx], ebx
mov dword [ecx + 4], ebx
mov dword [ecx + 8], ebx
call fcn.0040152a
lea ecx, [esi + 0x90]
mov byte [esi + 0x8c], bl
mov byte [esi + 0x8d], bl
push 0xf
mov byte [ebp - 4], 3
mov dword [ecx], ebx
mov dword [ecx + 4], ebx
mov dword [ecx + 8], ebx
call fcn.0040152a
lea ecx, [esi + 0xa0]
mov byte [esi + 0x9c], bl
mov byte [esi + 0x9d], bl
mov byte [esi + 0x9e], bl
push 0xf
mov byte [ebp - 4], 4
mov dword [ecx], ebx
mov dword [ecx + 4], ebx
mov dword [ecx + 8], ebx
call fcn.0040152a
lea ecx, [esi + 0xac]
push 0xf
mov byte [ebp - 4], 5
mov dword [ecx], ebx
mov dword [ecx + 4], ebx
mov dword [ecx + 8], ebx
call fcn.0040152a
mov ecx, dword [ebp - 0xc]
lea eax, [esi + 0xb8]
mov dword [eax + 4], ebx
mov dword [eax + 8], ebx
mov dword [eax + 0xc], ebx
mov dword [eax + 0x10], 8
mov dword [eax], 0x41d3c0
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x404153
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
mov eax, 0x41a6e8
call fcn.00419c80
push ecx
push ebx
push esi
push edi
push 0xf
mov esi, ecx
pop edi
xor ebx, ebx
push edi
mov dword [ebp - 0x10], esi
mov dword [esi], ebx
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
call fcn.0040152a
lea ecx, [esi + 0xc]
push edi
mov dword [ebp - 4], ebx
mov dword [ecx], ebx
mov dword [ecx + 4], ebx
mov dword [ecx + 8], ebx
call fcn.0040152a
lea ecx, [esi + 0x18]
push edi
mov byte [ebp - 4], 1
mov dword [ecx], ebx
mov dword [ecx + 4], ebx
mov dword [ecx + 8], ebx
call fcn.0040152a
lea ecx, [esi + 0x24]
push edi
mov byte [ebp - 4], 2
mov dword [ecx], ebx
mov dword [ecx + 4], ebx
mov dword [ecx + 8], ebx
call fcn.0040152a
lea ecx, [esi + 0x34]
mov byte [esi + 0x30], bl
push edi
mov byte [ebp - 4], 3
mov dword [ecx], ebx
mov dword [ecx + 4], ebx
mov dword [ecx + 8], ebx
call fcn.0040152a
lea ecx, [esi + 0x40]
push edi
mov byte [ebp - 4], 4
mov dword [ecx], ebx
mov dword [ecx + 4], ebx
mov dword [ecx + 8], ebx
call fcn.0040152a
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x1000475b
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push 0x108
call fcn.100092c0
add esp, 4
mov dword [ebp - 4], eax
mov edi, eax
mov esi, 0x55129d
lodsd eax, dword [esi]
stosd dword es:[edi], eax
lodsd eax, dword [esi]
stosd dword es:[edi], eax
xor eax, eax
mov ecx, 0x40
rep stosd dword es:[edi], eax
push 0x108
call fcn.100092c0
add esp, 4
mov dword [ebp - 8], eax
mov edi, eax
mov esi, 0x55129d
lodsd eax, dword [esi]
stosd dword es:[edi], eax
lodsd eax, dword [esi]
stosd dword es:[edi], eax
xor eax, eax
mov ecx, 0x40
rep stosd dword es:[edi], eax
mov dword [ebp - 0xc], 0
mov ebx, dword [ebp - 4]
call fcn.100010b3
mov eax, 0
cmp eax, ecx
jl 0x100047db
push 0
push 0x4011022
push 1
call fcn.100092c6
add esp, 0xc
add ebx, eax
mov dword [ebp - 0x10], ebx
mov ebx, dword [ebp - 0x10]
mov byte [ebx], 0
mov ebx, dword [ebp - 8]
call fcn.100010b3
mov eax, 0
cmp eax, ecx
jl 0x1000480e
push 0x29
push 0x4011022
push 1
call fcn.100092c6
add esp, 0xc
add ebx, eax
mov dword [ebp - 0x10], ebx
mov ebx, dword [ebp - 0x10]
mov byte [ebx], 0
mov eax, dword [ebp - 4]
add eax, 8
mov ecx, 0x100
xor ebx, ebx
sub bl, cl
mov byte [ebx + eax], bl
loop 0x10004824
push eax
mov edx, dword [ebp + 0x10]
mov edx, dword [edx]
mov edi, dword [edx + 4]
add edx, 8
mov esi, dword [ebp - 8]
add esi, 8
mov ecx, 0x100
xor ebx, ebx
cmp ebx, edi
jb 0x1000484c
xor ebx, ebx
mov ah, byte [ebx + edx]
mov byte [esi], ah
inc esi
inc ebx
loop 0x10004846
pop edi
xor ebx, ebx
sub esi, 0x100
xor eax, eax
mov ecx, 0x100
mov dl, byte [eax + esi]
add bl, dl
mov dl, byte [eax + edi]
add bl, dl
mov dl, byte [eax + edi]
mov dh, byte [ebx + edi]
mov byte [eax + edi], dh
mov byte [ebx + edi], dl
inc eax
loop 0x10004865
mov esi, dword [ebp + 8]
mov esi, dword [esi]
mov ecx, dword [esi + 4]
mov dword [ebp - 0xc], ecx
add esi, 8
push 0x80000301
push 0
push dword [ebp - 0xc]
push 1
mov ebx, 0x1bc
call fcn.10009f20
add esp, 0x10
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
push eax
mov ebx, dword [ebp + 0xc]
mov ebx, dword [ebx]
test ebx, ebx
je 0x100048c1
push ebx
call fcn.100092ba
add esp, 4
pop eax
mov ebx, dword [ebp + 0xc]
mov dword [ebx], eax
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp + 0xc]
mov edx, dword [edx]
add edx, 8
xor eax, eax
xor ebx, ebx
push ecx
movzx ecx, al
inc cl
push edx
mov dh, byte [ecx + edi]
add bl, dh
mov dl, byte [ebx + edi]
mov byte [ecx + edi], dl
mov byte [ebx + edi], dh
add dl, dh
movzx edx, dl
mov dl, byte [edx + edi]
mov cl, byte [eax + esi]
xor cl, dl
pop edx
mov byte [eax + edx], cl
inc eax
pop ecx
loop 0x100048d6
mov ebx, dword [ebp - 4]
push ebx
call fcn.100092ba
add esp, 4
mov ebx, dword [ebp - 8]
push ebx
call fcn.100092ba
add esp, 4
mov esp, ebp
pop ebp
ret 0xc

Function at 0x1000aa90
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 4]
mov eax, dword [esp + 8]
cmp edx, 1
jle 0x1000aaae
push esi
lea ecx, [esp + 0x18]
dec edx
mov esi, dword [ecx]
add ecx, 0xc
xor eax, esi
dec edx
jne 0x1000aaa3
pop esi
ret
Function at 0x438ca2
Capabilities:
Encode data using xor

Disassembly:
mov edi, 0x438a14
add ecx, 0x164a5be5
sub esi, ecx
add esi, 0xc995f43
call fcn.00438cf1
mov ecx, 0x6e2fbe31
sub ecx, 0x5fe7a428
xor dword [ebx], edi
dec esi
add esi, 0x1a14a744
add ebx, 1
inc esi
cmp ebx, eax
jne fcn.00438ca2
push 0x46f85c64
mov ecx, dword [esp]
add esp, 4
add esi, 0xdb9f7f46
ret

Function at 0x4765c0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x4b000]
push edi
or ebp, 0xffffffff
jmp 0x4765e2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x4765e9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4765d8
mov eax, 1
add ebx, ebx
jne 0x4765fb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x47660c
jne 0x47662b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x47662b
dec eax
add ebx, ebx
jne 0x476618
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x4765f0
add ebx, ebx
jne 0x476627
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x47667d
xor ecx, ecx
sub eax, 3
jb 0x476643
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x4766b2
sar eax, 1
mov ebp, eax
jmp 0x47664e
add ebx, ebx
jne 0x47664e
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x47661c
inc ecx
add ebx, ebx
jne 0x47665c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x47661c
add ebx, ebx
jne 0x476669
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x47665e
jne 0x47667a
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x47665e
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x47669c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x47668e
jmp 0x4765de
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x47669c
add edi, ecx
jmp 0x4765de
pop esi
mov edi, esi
mov ecx, 0x2aee
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x4766ba
cmp byte [edi], 0x26
jne 0x4766ba
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x4766bf
lea edi, [esi + 0x73000]
mov eax, dword [edi]
or eax, eax
je 0x476737
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x776bc]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x777d4]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x4766ec
mov ecx, edi
jns 0x47671b
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x777d8]
or eax, eax
je 0x476731
mov dword [ebx], eax
add ebx, 4
jmp 0x476709
call dword [esi + 0x777e0]
mov ebp, dword [esi + 0x777dc]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x237]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x47676b
sub esp, 0xffffff80
jmp 0x4422e4
Function at 0x452710
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x4d000]
push edi
jmp 0x45272a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x452731
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x452720
mov eax, 1
add ebx, ebx
jne 0x452743
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x452754
jne 0x452773
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x452773
dec eax
add ebx, ebx
jne 0x452760
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x452738
add ebx, ebx
jne 0x45276f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x4527c5
xor ecx, ecx
sub eax, 3
jb 0x45278b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x4527fa
sar eax, 1
mov ebp, eax
jmp 0x452796
add ebx, ebx
jne 0x452796
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x452764
inc ecx
add ebx, ebx
jne 0x4527a4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x452764
add ebx, ebx
jne 0x4527b1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x4527a6
jne 0x4527c2
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4527a6
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x4527e4
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x4527d6
jmp 0x452726
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x4527e4
add edi, ecx
jmp 0x452726
pop esi
mov edi, esi
mov ecx, 0x1f9
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x452802
cmp byte [edi], 4
jne 0x452802
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x452807
lea edi, [esi + 0x50000]
mov eax, dword [edi]
or eax, eax
je 0x45287f
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x52000]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x520a0]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x452834
mov ecx, edi
jns 0x452863
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x520a4]
or eax, eax
je 0x452879
mov dword [ebx], eax
add ebx, 4
jmp 0x452851
call dword [esi + 0x520b4]
mov ebp, dword [esi + 0x520a8]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1cf]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x4528b3
sub esp, 0xffffff80
jmp 0x408310
Function at 0x4d2720
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdec
push ebx
xor ecx, ecx
mov dword [ebp - 8], ecx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405888
xor eax, eax
push ebp
push 0x4d27b5
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
mov ecx, 0x4d27cc
mov edx, dword [ebp - 4]
call fcn.00405720
push 0xff
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
push 0xff
lea eax, [ebp - 0x114]
push eax
mov eax, dword [ebp - 8]
call fcn.00405898
push eax
call sub.kernel32.dll_GetVolumeInformationA
mov eax, dword [ebp - 0xc]
xor edx, edx
push edx
push eax
mov eax, ebx
call fcn.0040a420
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d27bc
lea eax, [ebp - 8]
mov edx, 2
call fcn.0040542c
ret

Function at 0x4d289c
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
xor ecx, ecx
mov dword [ebp - 8], ecx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405888
xor eax, eax
push ebp
push 0x4d2976
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
mov ecx, 0x4d298c
mov edx, dword [ebp - 4]
call fcn.00405720
mov eax, dword [ebp - 8]
call fcn.00405898
push eax
call sub.kernel32.dll_GetDriveTypeA
cmp eax, 6
ja case.0x4d28e6.0
jmp dword [eax*4 + 0x4d28ed]
mov eax, ebx
mov edx, 0x4d2998
call fcn.0040545c
jmp 0x4d295b
mov eax, ebx
mov edx, 0x4d29a8
call fcn.0040545c
jmp 0x4d295b
mov eax, ebx
mov edx, 0x4d29b8
call fcn.0040545c
jmp 0x4d295b
mov eax, ebx
mov edx, 0x4d29c8
call fcn.0040545c
jmp 0x4d295b
mov eax, ebx
mov edx, 0x4d29d8
call fcn.0040545c
jmp 0x4d295b
mov eax, ebx
mov edx, 0x4d29e8
call fcn.0040545c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d297d
lea eax, [ebp - 8]
mov edx, 2
call fcn.0040542c
ret
Function at 0x4d4c78
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe28
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x1d4], edx
mov dword [ebp - 0x1d8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405888
xor eax, eax
push ebp
push 0x4d4db9
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
push ebp
push 0x4d4d89
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 4]
call fcn.00405898
mov ebx, eax
push ebx
call sub.kernel32.dll_DeleteFileA
push ebx
call sub.kernel32.dll_DeleteFileA
mov eax, dword [ebp - 4]
call fcn.0040aa28
test al, al
jne 0x4d4cf9
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
push ebx
call sub.kernel32.dll_CreateFileA_1
push eax
call sub.kernel32.dll_CloseHandle_1
mov edx, dword [ebp - 4]
lea eax, [ebp - 0x1d0]
call fcn.00403858
lea eax, [ebp - 0x1d0]
call fcn.004035f4
call fcn.004030d4
push dword [0x4e4f5c]
push 0x4d4dd0
push dword [0x4e4f60]
push 0x4d4dd0
push dword [0x4e4f64]
lea eax, [ebp - 0x1d8]
mov edx, 5
call fcn.0040579c
mov eax, dword [ebp - 0x1d8]
lea edx, [ebp - 0x1d4]
call fcn.004d0414
mov edx, dword [ebp - 0x1d4]
lea eax, [ebp - 0x1d0]
call fcn.00405bb8
call fcn.00403f50
call fcn.004030d4
lea eax, [ebp - 0x1d0]
call fcn.00403920
call fcn.004030d4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4d4d93
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d4dc0
lea eax, [ebp - 0x1d8]
mov edx, 2
call fcn.0040542c
lea eax, [ebp - 4]
call fcn.00405408
ret