joyce8/EMBER2024-capa huggingface dataset:
Function at 0x433868
Capabilities:
Log keystrokes via polling

Disassembly:
push esi
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
push edi
push 0x11
xor edi, edi
call esi
test ax, ax
jns 0x43387e
push 8
pop edi
push 2
call esi
test ax, ax
jns 0x43388a
or edi, 1
push 1
call esi
test ax, ax
jns 0x433896
or edi, 2
push 0x10
call esi
test ax, ax
jns 0x4338a2
or edi, 4
push 0x12
call esi
test ax, ax
jns 0x4338ae
or edi, 0x20
mov eax, edi
pop edi
pop esi
ret

Function at 0x43548b
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
mov esi, ecx
call dword [sym.imp.USER32.dll_GetFocus]
mov ecx, dword [esi]
mov ebx, dword [ebp + 8]
cmp eax, ecx
je 0x4354b0
cmp ebx, dword [esi + 0x54]
je 0x4354b0
push ecx
call dword [sym.imp.USER32.dll_SetFocus]
mov eax, dword [esi + 0x54]
cmp ebx, eax
je 0x435572
push edi
test eax, eax
je 0x435503
push 7
pop ecx
xor eax, eax
lea edi, [ebp - 0x1c]
rep stosd dword es:[edi], eax
mov dword [ebp - 0x20], 0x14
mov dword [ebp - 0x1c], ebx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [esi + 0x54]
lea edx, [ebp - 0x20]
mov dword [ebp - 0x18], eax
mov eax, dword [ecx]
push edx
call dword [eax + pe_nt_image_headers32]
xor edi, edi
push edi
push edi
push edi
push str.killfocus
push dword [esi + 0x54]
mov ecx, esi
call fcn.00434fc5
mov dword [esi + 0x54], edi
test ebx, ebx
je 0x435571
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x1c]
cmp eax, esi
jne 0x435571
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0xc8]
test al, al
je 0x435571
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0xd4]
test al, al
je 0x435571
push 7
pop ecx
xor eax, eax
lea edi, [ebp - 0x1c]
rep stosd dword es:[edi], eax
mov dword [esi + 0x54], ebx
mov dword [ebp - 0x20], 0x15
mov dword [ebp - 0x1c], ebx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [esi + 0x54]
lea edx, [ebp - 0x20]
mov dword [ebp - 0x18], eax
mov eax, dword [ecx]
push edx
call dword [eax + pe_nt_image_headers32]
xor eax, eax
push eax
push eax
push eax
push str.setfocus
push dword [esi + 0x54]
mov ecx, esi
call fcn.00434fc5
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x435775
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
mov esi, ecx
push edi
lea ecx, [esi + 0xd0]
xor ebx, ebx
call fcn.0044b635
test eax, eax
jle 0x4357ca
push ebx
lea ecx, [esi + 0xd0]
mov byte [ebp - 1], 0
call fcn.004322b5
mov edx, dword [eax]
lea ecx, [ebp - 1]
push ecx
push dword [ebp + 0x10]
mov ecx, eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [edx]
cmp byte [ebp - 1], 0
jne 0x43582b
lea ecx, [esi + 0xd0]
inc ebx
call fcn.0044b635
cmp ebx, eax
jl 0x435791
mov eax, dword [ebp + 8]
sub eax, 0x100
je 0x435884
sub eax, 4
je 0x43582f
dec eax
dec eax
jne 0x43587b
push dword [ebp + 0xc]
mov word [ebp + 8], ax
lea edi, [ebp + 0xa]
stosw word es:[edi], ax
call fcn.00476463
pop ecx
mov ecx, dword [esi + 0x50]
push 0x8000000a
lea edx, [ebp + 8]
push edx
mov word [ebp + 8], ax
mov eax, dword [ecx]
push 0x434a57
call dword [eax + 0xfc]
mov esi, eax
test esi, esi
je 0x43587b
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0xf0]
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x18]
mov al, 1
jmp 0x43587d
cmp dword [esi + 0x54], 0
je 0x43587b
xor eax, eax
push 7
pop ecx
lea edi, [ebp - 0x20]
rep stosd dword es:[edi], eax
mov ax, word [ebp + 0xc]
mov word [ebp - 0x10], ax
mov eax, dword [esi + 0x64]
mov dword [ebp - 0x18], eax
mov eax, dword [esi + 0x68]
mov dword [ebp - 0x24], 6
mov dword [ebp - 0x14], eax
call fcn.00433868
mov word [ebp - 0xe], ax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [esi + 0x54]
lea edx, [ebp - 0x24]
mov dword [ebp - 0x1c], eax
mov eax, dword [ecx]
push edx
call dword [eax + pe_nt_image_headers32]
xor al, al
pop edi
pop esi
pop ebx
leave
ret 0x10
cmp dword [ebp + 0xc], 9
jne 0x43587b
cmp dword [esi + 0x54], 0
je 0x4358d3
mov ecx, dword [esi + 0x54]
mov eax, dword [ecx]
call dword [eax + 0xc8]
test al, al
je 0x4358d3
mov ecx, dword [esi + 0x54]
mov eax, dword [ecx]
call dword [eax + 0xd4]
test al, al
je 0x4358d3
mov ecx, dword [esi + 0x54]
mov eax, dword [ecx]
push str.RichEditUI
call dword [eax + 0xc]
push eax
call fcn.00475ef7
pop ecx
pop ecx
test eax, eax
je 0x4358d3
mov ecx, dword [esi + 0x54]
call fcn.004457e0
test al, al
jne 0x43587b
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
setns al
movzx eax, al
push eax
mov ecx, esi
call fcn.00435623
jmp 0x43582b
Function at 0x4386cc
Capabilities:
Get file size
Read file on windows

Disassembly:
push 0x2c4
mov eax, 0x47d0a5
call fcn.0041e96e
mov edi, dword [ebp + 8]
mov ebx, ecx
call fcn.00437cbc
call fcn.00433a16
push eax
lea ecx, [ebp - 0x94]
call fcn.004326c3
xor esi, esi
mov dword [ebp - 4], esi
call fcn.00433a1c
mov ecx, eax
call fcn.00432417
test al, al
je 0x438814
push edi
lea ecx, [ebp - 0x94]
call fcn.004324b3
push esi
push 0x80
push 3
push esi
push 1
push SysReAllocString
lea ecx, [ebp - 0x94]
call fcn.00432440
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x2d0], eax
push esi
cmp eax, 0xffffffff
jne 0x438770
push str.Error_opening_file
mov ecx, ebx
call fcn.00437e92
mov bl, al
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x94]
call fcn.004322ec
mov al, bl
call fcn.0041e9b8
ret 8
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
cmp edi, esi
jne 0x438785
push esi
push str.File_is_empty
jmp 0x43874e
cmp edi, 0x400000
jbe 0x438795
push esi
push str.File_too_large
jmp 0x43874e
push edi
mov dword [ebp - 0x2cc], esi
call fcn.0041a6de
pop ecx
push esi
lea ecx, [ebp - 0x2cc]
push ecx
push edi
push eax
push dword [ebp - 0x2d0]
mov dword [ebp - 0x2c8], eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
push dword [ebp - 0x2d0]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x2cc], edi
je 0x4387f0
push dword [ebp - 0x2c8]
call fcn.0041c11e
pop ecx
mov ecx, ebx
call fcn.00437cbc
push esi
push str.Could_not_read_file
jmp 0x43874e
push dword [ebp + 0xc]
mov ecx, ebx
push edi
push dword [ebp - 0x2c8]
call fcn.00438579
push dword [ebp - 0x2c8]
mov bl, al
call fcn.0041c11e
pop ecx
jmp 0x438757
call fcn.00433a1c
push eax
lea ecx, [ebp - 0x94]
call fcn.00432496
call fcn.00433a22
test al, al
je 0x438835
call fcn.00433a28
jmp 0x43884c
push 2
push esi
lea ecx, [ebp - 0x94]
call fcn.00432440
push eax
call fcn.0043dad0
add esp, 0xc
mov dword [ebp - 0x2c8], eax
cmp eax, esi
jne 0x438861
push esi
push str.Error_opening_zip_file
jmp 0x43874e
lea eax, [ebp - 0x2c4]
push eax
lea eax, [ebp - 0x2d0]
push eax
push 1
push edi
push dword [ebp - 0x2c8]
call fcn.0043c1e8
add esp, 0x14
test eax, eax
je 0x43888f
push esi
push str.Could_not_find_ziped_file
jmp 0x43874e
mov eax, dword [ebp - 0x98]
mov dword [ebp - 0x2cc], eax
cmp eax, esi
je 0x43877d
cmp eax, 0x400000
ja 0x43878d
push eax
call fcn.0041a6de
push 3
push dword [ebp - 0x2cc]
mov edi, eax
push edi
push dword [ebp - 0x2d0]
push dword [ebp - 0x2c8]
call fcn.0043db2e
add esp, 0x18
cmp eax, esi
je 0x438905
cmp eax, 0x600
je 0x438905
push edi
call fcn.0041c11e
pop ecx
call fcn.00433a22
test al, al
jne 0x4388fa
push dword [ebp - 0x2c8]
call fcn.0043db66
pop ecx
push esi
push str.Could_not_unzip_file
jmp 0x43874e
call fcn.00433a22
test al, al
jne 0x43891a
push dword [ebp - 0x2c8]
call fcn.0043db66
pop ecx
push dword [ebp + 0xc]
mov ecx, ebx
push dword [ebp - 0x2cc]
push edi
call fcn.00438579
push edi
jmp 0x438807
Function at 0x43ad25
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
test edx, edx
jne 0x43ad33
xor eax, eax
pop ebp
ret
mov eax, dword [ebp + 8]
push esi
push edi
mov edi, dword [ebp + 0x10]
not eax
mov ecx, 0xff
cmp edi, 8
jb 0x43adee
mov esi, edi
shr esi, 3
push ebx
movzx ebx, byte [edx]
xor ebx, eax
and ebx, ecx
shr eax, 8
xor eax, dword [ebx*4 + 0x48ca88]
movzx ebx, byte [edx + 1]
xor ebx, eax
and ebx, ecx
shr eax, 8
xor eax, dword [ebx*4 + 0x48ca88]
movzx ebx, byte [edx + 2]
xor ebx, eax
and ebx, ecx
shr eax, 8
xor eax, dword [ebx*4 + 0x48ca88]
movzx ebx, byte [edx + 3]
xor ebx, eax
and ebx, ecx
shr eax, 8
xor eax, dword [ebx*4 + 0x48ca88]
movzx ebx, byte [edx + 4]
xor ebx, eax
and ebx, ecx
shr eax, 8
xor eax, dword [ebx*4 + 0x48ca88]
movzx ebx, byte [edx + 5]
xor ebx, eax
and ebx, ecx
shr eax, 8
xor eax, dword [ebx*4 + 0x48ca88]
movzx ebx, byte [edx + 6]
xor ebx, eax
and ebx, ecx
shr eax, 8
xor eax, dword [ebx*4 + 0x48ca88]
movzx ebx, byte [edx + 7]
xor ebx, eax
and ebx, ecx
shr eax, 8
xor eax, dword [ebx*4 + 0x48ca88]
add edx, 8
sub edi, 8
dec esi
jne 0x43ad51
pop ebx
test edi, edi
je 0x43ae07
movzx esi, byte [edx]
xor esi, eax
and esi, ecx
shr eax, 8
xor eax, dword [esi*4 + 0x48ca88]
inc edx
dec edi
jne 0x43adf2
pop edi
not eax
pop esi
pop ebp
ret

Function at 0x43b2b4
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0x14]
push edi
mov edi, dword [ebp + 0xc]
imul edi, dword [ebp + 0x10]
cmp byte [esi], 0
je 0x43b2e8
push 0
lea eax, [ebp + 0x10]
push eax
push edi
push dword [ebp + 8]
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x43b2e3
mov byte [esi + 8], 1
mov eax, dword [ebp + 0x10]
jmp 0x43b310
mov ecx, dword [esi + 0x18]
mov eax, dword [esi + 0x14]
lea edx, [ecx + edi]
cmp edx, eax
jbe 0x43b2f9
sub eax, ecx
mov edi, eax
mov eax, dword [esi + 0x10]
push edi
add eax, ecx
push eax
push dword [ebp + 8]
call fcn.0041e1c0
add esp, 0xc
add dword [esi + 0x18], edi
mov eax, edi
xor edx, edx
div dword [ebp + 0xc]
pop edi
pop esi
pop ebp
ret

Function at 0x43c132
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
mov eax, dword [0x4a26b4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
test esi, esi
je 0x43c1da
movzx ecx, word [esi]
test cx, cx
je 0x43c1da
mov eax, esi
mov edx, esi
cmp cx, 0x2f
je 0x43c16d
cmp cx, 0x5c
jne 0x43c16f
mov eax, edx
add edx, 2
movzx ecx, word [edx]
test cx, cx
jne 0x43c161
cmp eax, esi
je 0x43c1ae
push edi
sub eax, esi
mov edi, eax
sar edi, 1
push edi
lea eax, [ebp - 0x20c]
push esi
push eax
call fcn.00475fa9
xor eax, eax
mov word [ebp + edi*2 - 0x20c], ax
lea eax, [ebp - 0x20c]
push eax
push ebx
call fcn.0043c132
add esp, 0x14
pop edi
lea eax, [ebp - 0x414]
push ebx
push eax
call fcn.00475f88
lea eax, [ebp - 0x414]
push esi
push eax
call fcn.00475f57
add esp, 0x10
push 0
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.0041b847
leave
ret
Function at 0x43d707
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
cmp dword [esi], 0
jne 0x43d782
cmp dword [esi + 4], 0xffffffff
jne 0x43d782
push edi
lea edi, [esi + 0x138]
push edi
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
push 0x4945ac
push edi
call fcn.00475f57
cmp dword [ebp + 0x10], 1
pop ecx
pop ecx
pop edi
jne 0x43d754
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileType]
cmp eax, 1
je 0x43d754
mov eax, 0x2000000
jmp 0x43d787
lea eax, [ebp + 0x10]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0043b0c1
add esp, 0x10
test eax, eax
jne 0x43d772
mov eax, dword [ebp + 0x10]
jmp 0x43d787
push eax
call fcn.0043d2f6
mov dword [esi], eax
mov eax, dword [0x4a7184]
pop ecx
jmp 0x43d787
mov eax, 0x1000000
pop esi
pop ebp
ret 0xc
Function at 0x4459ac
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, ecx
xor ebx, ebx
cmp dword [esi + 0x4d4], ebx
je 0x445a14
cmp dword [ebp + 8], 0x100
jne 0x445a03
cmp word [ebp + 0xc], 0xd
jne 0x445a03
cmp byte [esi + 0x4da], bl
je 0x4459ea
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x445a03
cmp byte [esi + 0x4db], bl
jne 0x445a03
mov ecx, dword [esi + 0x40]
cmp ecx, ebx
je 0x4459ff
push ebx
push ebx
push ebx
push 0x48d888
push esi
call fcn.00434fc5
xor eax, eax
jmp 0x445a17
mov eax, dword [esi + 0x4d4]
mov ecx, dword [eax + 0xc]
mov eax, dword [ecx]
pop esi
pop ebx
pop ebp
jmp dword [eax + 0xc]
xor eax, eax
inc eax
pop esi
pop ebx
pop ebp
ret 0x10

Function at 0x450250
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [0x4a26b4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
cmp byte [esi + 0x18], bl
je 0x4502c1
cmp dword [esi + 0x10], ebx
je 0x4502c1
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
lea edi, [eax + 1]
lea eax, [edi + edi]
call fcn.0042a4b0
mov dword [ebp - 8], esp
cmp esp, ebx
je 0x4502c1
push edi
push dword [ebp - 8]
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov ecx, dword [esi + 0x10]
push dword [ebp - 8]
add ecx, 0x1b8
call fcn.00432472
mov ecx, dword [esi + 0x10]
mov eax, dword [ecx]
push ebx
push ebx
push ebx
push str.textchanged
push ecx
call dword [eax + 0x1c]
mov ecx, eax
call fcn.00434fc5
xor eax, eax
lea esp, [ebp - 0x14]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041b847
leave
ret 0x10
Function at 0x45e736
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, eax
mov eax, dword [esi + 8]
push edi
mov edi, eax
and edi, 7
je 0x45e75b
cmp eax, edi
jge 0x45e753
mov eax, esi
call fcn.0045e0f4
mov ecx, edi
shr dword [esi + 0xc], cl
sub dword [esi + 8], edi
mov edi, dword [esi + 8]
xor ecx, ecx
test edi, edi
jle 0x45e788
mov eax, dword [esi + 0xc]
push ebx
mov dl, byte [esi + 0xc]
sub edi, 8
mov byte [ebp + ecx - 4], dl
shr eax, 8
mov ebx, edi
inc ecx
mov dword [esi + 0xc], eax
test ebx, ebx
jg 0x45e768
mov dword [esi + 8], ebx
pop ebx
cmp ecx, 4
jge 0x45e7a7
mov edi, dword [esi + 4]
mov eax, dword [esi]
cmp eax, edi
jb 0x45e795
xor eax, eax
jmp 0x45e79d
mov dl, byte [eax]
inc eax
mov dword [esi], eax
movzx eax, dl
mov byte [ebp + ecx - 4], al
inc ecx
cmp ecx, 4
jl 0x45e78b
movzx edi, byte [ebp - 3]
movzx eax, byte [ebp - 4]
movzx ecx, byte [ebp - 2]
shl edi, 8
add edi, eax
movzx eax, byte [ebp - 1]
shl eax, 8
add eax, ecx
mov ecx, edi
xor ecx, 0xffff
cmp eax, ecx
je 0x45e7d9
mov eax, str.zlib_corrupt
call fcn.0045b9cc
jmp 0x45e814
mov eax, dword [esi]
add eax, edi
cmp eax, dword [esi + 4]
jbe 0x45e7e9
mov eax, str.read_past_buffer
jmp 0x45e7d2
mov eax, dword [esi + 0x10]
add eax, edi
cmp eax, dword [esi + 0x18]
jbe 0x45e7fe
mov ecx, edi
call fcn.0045e12a
test eax, eax
je 0x45e814
push edi
push dword [esi]
push dword [esi + 0x10]
call fcn.0041e1c0
add dword [esi], edi
add dword [esi + 0x10], edi
xor eax, eax
add esp, 0xc
inc eax
pop edi
pop esi
leave
ret
Function at 0x4dcaae
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x535df0]
jne 0x4dcab8
repz ret
jmp fcn.004dd098
Function at 0x102a684e
Capabilities:
Parse pe header

Disassembly:
mov word [esp + 0x79a], 0x63
pushal
mov word [esp], 0xdb8d
push 0x20b45
mov word [esp + 0x7c0], 0x45
pushfd
push 0xe981d2cb
push 0xd097aa26
mov word [esp + 0x7ce], dx
jmp loc.102964ed
mov word [esp + 0x794], di
push 0x36f63a38
jmp 0x102a4de7

Function at 0xe27e70
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0xa19000]
push edi
jmp 0xe27e8a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0xe27e91
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xe27e80
mov eax, 1
add ebx, ebx
jne 0xe27ea3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0xe27e98
jne 0xe27eb4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0xe27e98
xor ecx, ecx
sub eax, 3
jb 0xe27ec8
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0xe27f3a
mov ebp, eax
add ebx, ebx
jne 0xe27ed3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0xe27ee0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0xe27f04
inc ecx
add ebx, ebx
jne 0xe27ef0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0xe27ee5
jne 0xe27f01
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0xe27ee5
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0xe27f24
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0xe27f15
jmp 0xe27e86
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0xe27f24
add edi, ecx
jmp 0xe27e86
pop esi
mov edi, esi
mov ecx, 0xbee
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0xe27f42
cmp byte [edi], 6
jne 0xe27f42
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0xe27f47
lea edi, [esi + 0xa25000]
mov eax, dword [edi]
or eax, eax
je 0xe27fb6
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xa29cfc]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xa29d98]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0xe27f74
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xa29da0]
or eax, eax
je 0xe27fb0
mov dword [ebx], eax
add ebx, 4
jmp 0xe27f91
call dword [esi + 0xa29d9c]
mov ebp, dword [esi + 0xa29da4]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x21f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0xe27fea
sub esp, 0xffffff80
jmp 0x419acc
Function at 0x40c950
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x6000]
push edi
or ebp, 0xffffffff
jmp 0x40c972
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x40c979
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x40c968
mov eax, 1
add ebx, ebx
jne 0x40c98b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x40c980
jne 0x40c99c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x40c980
xor ecx, ecx
sub eax, 3
jb 0x40c9b0
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x40ca22
mov ebp, eax
add ebx, ebx
jne 0x40c9bb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x40c9c8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x40c9ec
inc ecx
add ebx, ebx
jne 0x40c9d8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x40c9cd
jne 0x40c9e9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x40c9cd
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x40ca0c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x40c9fd
jmp 0x40c96e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x40ca0c
add edi, ecx
jmp 0x40c96e
pop esi
mov edi, esi
mov ecx, 9
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x40ca2a
cmp byte [edi], 5
jne 0x40ca2a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov eax, ebx
loop 0x40ca2f
lea edi, [esi + 0xa000]
mov eax, dword [edi]
or eax, eax
je 0x40caa7
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xcfb0]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xcfec]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x40ca5c
mov ecx, edi
jns 0x40ca8b
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xcff0]
or eax, eax
je 0x40caa1
mov dword [ebx], eax
add ebx, 4
jmp 0x40ca79
call dword [esi + 0xcff4]
popal
jmp 0x4011dc
Function at 0x15b6f5e
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push dword [esp]
cmp cx, si
test eax, eax
mov byte [esp + 8], 0x7f
pushfd
mov word [esp], 0xb664
push dword [esp + 4]
lea esp, [esp + 0x30]
je fcn.015dbf9d
movsx dx, al
add dx, 0x4d96
inc dh
mov esi, dword [eax + 0x3c]
pushfd
sbb dh, 0x49
setge dl
add esi, eax
rol dl, 7
shl dh, 6
lea edx, [ebp + 0x4b3803d2]
rol dh, 2
mov edx, dword [esi + 0x78]
call fcn.015b7b8e

Function at 0x15bd98b
Capabilities:
Encode data using xor

Disassembly:
xor al, 0x7d
stosb byte es:[edi], al
and al, 0xec
cli
cmp byte [esi], ch
inc eax
cmp al, 0x50
adc byte [edx - 0x343a615f], 3
stosd dword es:[edi], eax
or dword [esi + 0x264226b1], esi
sbb dword [edx], 0x70
push ss
js 0x15bd987
test eax, 0xe6f94c3a
jns 0x15bd956
xchg esi, eax
wait
fstp st(4)
dec ecx
cmp edx, dword [ebp + 4]
add ah, byte [ecx + ecx]
xor ebx, dword [eax + 0x60]
std
mov edi, dword [edi + ecx*4]
pushal
mov byte [esp + 0xc], ah
cmp ch, bl
test edi, edi
push edi
lea esp, [esp + 0x34]
je fcn.015dbf9d
pushal
add eax, edi
stc
cmp eax, edx
pushal
mov word [esp + 0x10], 0xff3f
call fcn.015c2004
mov dword [esp + 0x10], 0x4fe8ff3f
inc esi
add byte [eax], al
mov bl, byte [esi + 0x63]
mov al, 0x8b
xor al, 0x3d
test al, 0xf9
outsd dx, dword [esi]
pop esi
loope 0x15bd9aa
jge 0x15bd973
mov ecx, 0x17263788
sbb al, byte [ebp + 0x5a91492a]
in al, 0x15
pop ss
xor byte es:[0xfb398b35], 0x86
dec eax
lds ebp, [eax]
inc esp
adc eax, 0xe8f4be89
in al, dx
add dword [edi + 0x75], 0x90864c42
push edx
pop eax
sahf
push ebp
cmpsw word [esi], word es:[edi]
xchg edx, eax
sahf
push edx
lahf
scasb al, byte es:[edi]
mov esp, 0x7bb67c72
dec edx
xchg ebx, eax
add dh, byte [edx + 0x26]
in eax, 0x74
push ebp
std
and ch, ah
insb byte es:[edi], dx
cdq
push ecx
inc ebp
sub eax, 0xfa8fc7a
into
outsd dx, dword [esi]
mov ss, word [eax]
call 0xb2d553cb
mov cl, 2
pop ss
jmp 0x79a6f2f9

Function at 0x15c33b1
Capabilities:
Encode data using xor

Disassembly:
push edi
lea esp, [esp + 0x34]
je 0x15bfa38
call fcn.015e223b
mov edx, 0x91aa79b5
xchg ecx, eax
xchg ecx, ebp
cmp edx, dword [esi + 0x19dff8b5]
xor ecx, dword [ebx + edx*8]
in al, dx
daa
adc al, 0xd5
loopne 0x15c33c5
and al, 0x2e
call 0xf98c64ce
xor eax, 0x1d41004
cmp byte [eax], ah
loopne 0x15c3446
xchg ecx, eax
sub byte [ebx], dh
pop esi
mov al, byte [0x72b80736]
sbb al, 0x4d
fucomi st(2)
push ebp
nop
lahf
cmp al, 0x7b
or eax, 0x399d8e75
push ecx
push ds
popfd
xchg ecx, eax
mov ecx, 0x8363c0d
jmp 0xe9e4a5d0
scasb al, byte es:[edi]
or edi, ecx
fld1
push edi
push edx
ret