joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45f2b0
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x497cd8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
push esi
mov esi, ecx
lea eax, [esp + 0xc]
mov ecx, dword [esi + 0x1c]
push eax
push ecx
call dword [sym.imp.USER32.dll_GetClientRect]
push 0
lea ecx, [esp + 0x20]
call fcn.0048eaf9
mov eax, dword [esi + 0xd0]
lea edx, [esp + 0x1c]
push eax
push eax
push edx
mov dword [esp + 0x44], 0
call fcn.0045ec50
mov eax, dword [esi + 0x4c]
mov ecx, dword [esi + 0x48]
add eax, 0x64
add esp, 0xc
add ecx, 0x64
mov dword [esp + 8], eax
lea eax, [esp + 4]
mov dword [esp + 4], ecx
push eax
lea ecx, [esp + 0x20]
call fcn.0048ea27
mov ecx, dword [esp + 4]
mov eax, dword [esp + 0x14]
mov edx, dword [esp + 0xc]
sub ecx, eax
add ecx, edx
mov eax, 0x88888889
imul ecx
add edx, ecx
push 1
sar edx, 4
mov ecx, edx
shr ecx, 0x1f
lea eax, [edx + ecx + 1]
xor edx, edx
test eax, eax
setl dl
dec edx
mov ecx, esi
and eax, edx
push eax
push 0
push 0
call fcn.0048b216
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 8]
sub ecx, eax
add ecx, edx
mov eax, 0x88888889
imul ecx
add edx, ecx
xor ecx, ecx
sar edx, 4
mov eax, edx
push 1
shr eax, 0x1f
lea eax, [edx + eax + 1]
test eax, eax
setl cl
dec ecx
and eax, ecx
mov ecx, esi
push eax
push 0
push 1
call fcn.0048b216
push 1
push 0
push 0
mov ecx, esi
call fcn.0048b1be
push 1
push 0
push 1
mov ecx, esi
call fcn.0048b1be
lea ecx, [esp + 0x1c]
mov dword [esp + 0x38], 0xffffffff
call fcn.0048eb6b
mov ecx, dword [esp + 0x30]
pop esi
mov dword fs:[0], ecx
add esp, 0x38
ret

Function at 0x45f430
Capabilities:
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x497cf8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
push esi
mov esi, ecx
push 0
lea ecx, [esp + 0x20]
call fcn.0048eaf9
push 0x3e8
lea eax, [esp + 0x20]
push 0x3e8
push eax
mov dword [esp + 0x44], 0
call fcn.0045ec50
mov ecx, dword [esi + 0x48]
mov eax, dword [esi + 0x4c]
add ecx, 0x64
add esp, 0xc
mov dword [esp + 4], ecx
lea ecx, [esp + 4]
add eax, 0x96
push ecx
lea ecx, [esp + 0x20]
mov dword [esp + 0xc], eax
call fcn.0048ea27
mov eax, dword [esi + 0x1c]
lea edx, [esp + 0xc]
push edx
push eax
call dword [sym.imp.USER32.dll_GetClientRect]
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x10]
sub eax, edx
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
shl eax, 3
cdq
idiv dword [esp + 8]
mov edx, dword [esp + 0xc]
mov ecx, eax
mov eax, dword [esp + 0x14]
sub eax, edx
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
shl eax, 3
cdq
idiv dword [esp + 4]
cmp dword [esp + 0x44], 1
jne 0x45f4f4
cmp dword [esp + 0x40], 1
jne 0x45f4f2
cmp ecx, eax
jge 0x45f4f4
mov eax, ecx
cmp eax, 0xc8
jge 0x45f500
mov eax, 0xc8
mov ecx, esi
mov dword [esi + 0xd0], eax
call fcn.0045f2b0
mov ecx, dword [esi + 0x1c]
push 1
push 0
push ecx
call dword [sym.imp.USER32.dll_InvalidateRect]
lea ecx, [esp + 0x1c]
mov dword [esp + 0x38], 0xffffffff
call fcn.0048eb6b
mov ecx, dword [esp + 0x30]
pop esi
mov dword fs:[0], ecx
add esp, 0x38
ret 8
Function at 0x45fc80
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x497d63
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
call fcn.0048962f
lea edi, [esi + 0x64]
mov dword [esp + 0x18], 0
mov dword [edi + 4], 0
mov dword [edi], vtable.CBrush.0
mov eax, dword [esp + 0x2c]
mov ebp, dword [esp + 0x24]
mov ecx, dword [esp + 0x30]
mov dword [esi + 0x3c], eax
mov eax, ebp
mov dword [esi], method.CEdit.virtual_0
mov dword [esi + 0x40], ecx
mov dword [esi + 0x44], 0
mov ecx, dword [eax]
lea edx, [esi + 0x48]
mov byte [esp + 0x18], 1
mov dword [edx], ecx
mov ecx, dword [eax + 4]
mov dword [edx + 4], ecx
mov ecx, dword [eax + 8]
mov dword [edx + 8], ecx
mov eax, dword [eax + 0xc]
mov ecx, dword [esp + 0x40]
mov dword [edx + 0xc], eax
mov eax, dword [esp + 0x44]
push eax
mov dword [esi + 0x5c], ecx
mov dword [esi + 0x60], eax
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
push eax
mov ecx, edi
call fcn.0048eda1
mov edx, dword [esp + 0x28]
mov eax, dword [esp + 0x20]
push edx
push eax
push ebp
push 0x50800044
mov ecx, esi
call fcn.004902f9
test eax, eax
je 0x45fd9c
mov ecx, dword [esp + 0x3c]
call fcn.0048edce
mov ecx, dword [esi + 0x1c]
mov ebp, dword [sym.imp.USER32.dll_SendMessageA]
push 0
push eax
push 0x30
push ecx
mov dword [esi + 0x58], eax
call ebp
mov edi, dword [esp + 0x34]
test edi, edi
je 0x45fd60
push edi
mov ecx, esi
call fcn.0048c398
mov ecx, esi
call fcn.0045ff00
cmp dword [esp + 0x38], 1
jne 0x45fd95
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
mov edx, dword [esi + 0x1c]
push 0xffffffffffffffff
not ecx
dec ecx
push ecx
push 0xb1
push edx
call ebp
mov eax, dword [esi + 0x1c]
push 0
push 0
push 0xb7
push eax
call ebp
mov ecx, esi
call fcn.0048c502
mov ecx, dword [esp + 0x10]
mov eax, esi
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x10
ret 0x28
Function at 0x4627d0
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x10], 0xca
jne 0x462803
push esi
call fcn.004658e0
mov eax, dword [esi + 0x40]
add esp, 4
test eax, eax
je 0x4627fc
mov dword [esi + 0x10], 0xcf
mov eax, 1
pop esi
ret
mov dword [esi + 0x10], 0xcb
mov eax, dword [esi + 0x10]
cmp eax, 0xcb
jne 0x462889
mov eax, dword [esi + 0x1b0]
mov ecx, dword [eax + 0x10]
test ecx, ecx
je 0x462872
mov eax, dword [esi + 8]
test eax, eax
je 0x462827
push esi
call dword [eax]
add esp, 4
mov ecx, dword [esi + 0x1b0]
push esi
call dword [ecx]
add esp, 4
test eax, eax
je 0x46286e
cmp eax, 2
je 0x462872
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x46281a
cmp eax, 3
je 0x46284d
cmp eax, 1
jne 0x46281a
mov eax, dword [ecx + 4]
inc eax
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov ecx, dword [eax + 8]
mov edx, dword [eax + 4]
cmp edx, ecx
jl 0x46281a
mov edx, dword [esi + 0x13c]
add edx, ecx
mov dword [eax + 8], edx
jmp 0x46281a
xor eax, eax
pop esi
ret
mov eax, dword [esi + 0x90]
push esi
mov dword [esi + 0x98], eax
call fcn.004628b0
add esp, 4
pop esi
ret
cmp eax, 0xcc
je 0x462898
mov ecx, dword [esi]
push esi
call dword [ecx]
add esp, 4
push esi
call fcn.004628b0
add esp, 4
pop esi
ret

Function at 0x48a424
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x48a45c
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.004884b1
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.00488489
jmp 0x48a468
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x48bb1e
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x48bb60
call fcn.00491800
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x48bb60
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x48bb57
xor eax, eax
jmp 0x48bb68
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.0048bb6e
pop edi
pop esi
pop ebx
ret 4

Function at 0x491d30
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x491d5e
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x491d7c
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.00491c96
jmp 0x491d7c
mov eax, dword [esi + 0x14]
test eax, eax
je 0x491d7c
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.00491c96
test edi, edi
mov eax, edi
jne 0x491d66
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x401410
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
mov edi, edx
mov ebx, ecx
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x401467
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x401467
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [esp + 0x10]
lea edx, [esi + eax]
and ecx, 0xf
jbe 0x401456
cmp esi, edx
jae 0x401467
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub ecx, 1
jne 0x401444
cmp esi, edx
jae 0x401467
movzx eax, word [esi]
neg eax
pop edi
sbb eax, eax
and eax, esi
pop esi
pop ebx
ret
pop edi
pop esi
xor eax, eax
pop ebx
ret

Function at 0x40289a
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x4028d9
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4028d9
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4028d9
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x4028d9
cmp dword [ecx + 0x74], 0xe
jbe 0x4028d9
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x408c69
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x411d74
push 0x411d6c
push str.FlsAlloc
push 0x1f
call fcn.00408ba4
mov esi, eax
add esp, 0x10
test esi, esi
je 0x408c9d
push dword [ebp + 8]
mov ecx, esi
call dword [0x40f138]
call esi
jmp 0x408ca3
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x408ce7
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x411d84
push 0x411d7c
push str.FlsGetValue
push 0x21
call fcn.00408ba4
mov esi, eax
add esp, 0x10
test esi, esi
je 0x408d1e
push dword [ebp + 8]
mov ecx, esi
call dword [0x40f138]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x408d26
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x411d8c
push 0x411d84
push str.FlsSetValue
push 0x22
call fcn.00408ba4
mov esi, eax
add esp, 0x10
test esi, esi
je 0x408d60
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x40f138]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x40a4d7
Capabilities:
Enumerate files on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x264
mov eax, dword [0x418018]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x25c], ecx
cmp edx, edi
je 0x40a522
movzx eax, word [edx]
lea ecx, [ebp - 0x255]
push eax
call fcn.0040a672
test al, al
jne 0x40a51c
sub edx, 2
cmp edx, edi
jne 0x40a502
mov ecx, dword [ebp - 0x25c]
movzx esi, word [edx]
cmp esi, 0x3a
jne 0x40a544
lea eax, [edi + 2]
cmp edx, eax
je 0x40a544
push ecx
xor ebx, ebx
push ebx
push ebx
push edi
call fcn.0040a423
add esp, 0x10
jmp 0x40a63e
push esi
lea ecx, [ebp - 0x255]
call fcn.0040a672
sub edx, edi
movzx eax, al
sar edx, 1
inc edx
neg eax
sbb eax, eax
xor ebx, ebx
push ebx
push ebx
and eax, edx
push ebx
mov dword [ebp - 0x260], eax
lea eax, [ebp - 0x254]
push eax
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileExW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x40a587
push dword [ebp - 0x25c]
jmp 0x40a534
mov ebx, dword [ebp - 0x25c]
push 0x2e
mov eax, dword [ebx + 4]
sub eax, dword [ebx]
sar eax, 2
mov dword [ebp - 0x25c], eax
pop eax
cmp word [ebp - 0x228], ax
jne 0x40a5c4
cmp word [ebp - 0x226], 0
je 0x40a5e5
cmp word [ebp - 0x226], ax
jne 0x40a5c4
cmp word [ebp - 0x224], 0
je 0x40a5e5
push ebx
push dword [ebp - 0x260]
lea eax, [ebp - 0x228]
push edi
push eax
call fcn.0040a423
add esp, 0x10
mov dword [ebp - 0x264], eax
test eax, eax
jne 0x40a631
lea eax, [ebp - 0x254]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
push 0x2e
test eax, eax
pop eax
jne 0x40a59e
mov eax, dword [ebx + 4]
mov edx, dword [ebx]
sub eax, edx
mov ecx, dword [ebp - 0x25c]
sar eax, 2
cmp ecx, eax
jne 0x40a619
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
xor eax, eax
jmp 0x40a63e
push 0x40a253
sub eax, ecx
push 4
push eax
lea eax, [edx + ecx*4]
push eax
call fcn.0040c3c0
add esp, 0x10
jmp 0x40a60e
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [ebp - 0x264]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00402464
leave
ret

Function at 0x40de40
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x40de6d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x40de6d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x401b66
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x410004]
jne 0x401b70
repz ret
jmp fcn.0040324d

Function at 0x4028f2
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
pushal
call 0x402901
pop dword [ebp - 0x48]
mov eax, 0xcd9293e1
sub eax, 0xcd526ae0
sub dword [ebp - 0x48], eax
mov dword [ebp - 0x58], 0x2af1d813
add dword [ebp - 0x58], 0x23606d38
mov dword [ebp - 0x54], 0x808319b0
sub dword [ebp - 0x54], 0x4e4fcd6b
mov dword [ebp - 0x50], 0x2a185a15
add dword [ebp - 0x50], 0x2233ea19
mov dword [ebp - 0x4c], 0x6b89012b
add dword [ebp - 0x4c], 0x9476fed5
lea eax, [ebp - 0x58]
push eax
mov eax, 0xf2fb418a
sub eax, 0xf2ba713e
add eax, dword [ebp - 0x48]
call dword [eax]
mov dword [ebp - 0x58], 0xe48671a9
sub dword [ebp - 0x58], 0x70140853
mov dword [ebp - 0x54], 0xa16a3d1d
sub dword [ebp - 0x54], 0x5ffddba8
mov dword [ebp - 0x50], 0xf29914e0
sub dword [ebp - 0x50], 0x8f29a874
mov dword [ebp - 0x4c], 0x47402a7f
sub dword [ebp - 0x4c], 0x47402a7f
lea ebx, [ebp - 0x58]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x48]
call dword [eax]
push 0x40
push 0x1000
push 0x36ab3
push 0
call eax
mov ecx, 0xc70c5f35
add ecx, 0x38f3dda9
xor edi, edi
add edi, eax
mov edx, 0x41b000
add edx, dword [ebp - 0x48]
mov esi, 0x428287f0
sub esi, 0x73f49541
mov ebx, dword [edx]
add dword [ebp - 0x10], ecx
xor ebx, esi
xor dword [ebp - 0x44], ebx
mov dword [edi], ebx
add dword [ebp - 0x3c], 0xfde6e557
add edi, 0xb28e5177
sub edi, 0xb28e5173
add edx, 4
loop 0x402a1a
add eax, 0x73672e7d
sub eax, 0x73664832
xor ebx, ebx
add ebx, eax
add eax, 0x9fffc22a
add eax, 0x60003ddb
mov ecx, 0x4597932f
sub ecx, 0x4557932f
add ecx, dword [ebp - 0x48]
call ebx
leave
ret
Function at 0x437f90
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x27000]
push edi
or ebp, 0xffffffff
jmp 0x437fb2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x437fb9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x437fa8
mov eax, 1
add ebx, ebx
jne 0x437fcb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x437fc0
jne 0x437fdc
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x437fc0
xor ecx, ecx
sub eax, 3
jb 0x437ff0
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x438062
mov ebp, eax
add ebx, ebx
jne 0x437ffb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x438008
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x43802c
inc ecx
add ebx, ebx
jne 0x438018
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x43800d
jne 0x438029
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x43800d
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x43804c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x43803d
jmp 0x437fae
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x43804c
add edi, ecx
jmp 0x437fae
pop esi
mov edi, esi
mov ecx, 0x9b
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x43806a
cmp byte [edi], 5
jne 0x43806a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov eax, ebx
loop 0x43806f
lea edi, [esi + 0x35000]
mov eax, dword [edi]
or eax, eax
je 0x4380de
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x38434]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x38498]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x43809c
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x3849c]
or eax, eax
je 0x4380d8
mov dword [ebx], eax
add ebx, 4
jmp 0x4380b9
call dword [esi + 0x384a0]
popal
jmp 0x409516
Function at 0xd84f40
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x4b4000]
push edi
or ebp, 0xffffffff
jmp 0xd84f62
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0xd84f69
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xd84f58
mov eax, 1
add ebx, ebx
jne 0xd84f7b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0xd84f8c
jne 0xd84fab
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xd84fab
dec eax
add ebx, ebx
jne 0xd84f98
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0xd84f70
add ebx, ebx
jne 0xd84fa7
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0xd84ffd
xor ecx, ecx
sub eax, 3
jb 0xd84fc3
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0xd85032
sar eax, 1
mov ebp, eax
jmp 0xd84fce
add ebx, ebx
jne 0xd84fce
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xd84f9c
inc ecx
add ebx, ebx
jne 0xd84fdc
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xd84f9c
add ebx, ebx
jne 0xd84fe9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0xd84fde
jne 0xd84ffa
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0xd84fde
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0xd8501c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0xd8500e
jmp 0xd84f5e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0xd8501c
add edi, ecx
jmp 0xd84f5e
pop esi
mov edi, esi
mov ecx, 0x37e4
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0xd8503a
cmp byte [edi], 0x13
jne 0xd8503a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0xd8503f
lea edi, [esi + 0x981000]
mov eax, dword [edi]
or eax, eax
je 0xd850b7
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x9dfbe4]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x9dfca8]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0xd8506c
mov ecx, edi
jns 0xd8509b
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x9dfcb0]
or eax, eax
je 0xd850b1
mov dword [ebx], eax
add ebx, 4
jmp 0xd85089
call dword [esi + 0x9dfcac]
mov ebp, dword [esi + 0x9dfcb4]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x217]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0xd850eb
sub esp, 0xffffff80
jmp 0x46f1ee
Function at 0x401ea2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x410284]
jne 0x401eac
repz ret
jmp fcn.00403e53

Function at 0x406037
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
pushal
call 0x406046
pop dword [ebp - 0xc]
mov eax, 0xf4ca15da
add eax, 0xb764a6c
sub dword [ebp - 0xc], eax
mov dword [ebp - 0x1c], 0xf47cea0b
add dword [ebp - 0x1c], 0x59d55b40
mov dword [ebp - 0x18], 0xa5585c66
sub dword [ebp - 0x18], 0x73251021
mov dword [ebp - 0x14], 0xcf111864
sub dword [ebp - 0x14], 0x82c4d436
mov dword [ebp - 0x10], 0x979dcd5f
sub dword [ebp - 0x10], 0x979dcd5f
lea eax, [ebp - 0x1c]
push eax
mov eax, sym.imp.kernel32.dll_LoadLibraryA
add eax, dword [ebp - 0xc]
call dword [eax]
mov dword [ebp - 0x1c], 0x1e009cad
sub dword [ebp - 0x1c], 0xa98e3357
mov dword [ebp - 0x18], 0x4621a8b6
add dword [ebp - 0x18], 0xfb4ab8bf
mov dword [ebp - 0x14], 0xb855ac5a
add dword [ebp - 0x14], 0xab19c012
mov dword [ebp - 0x10], 0xc10c05ff
sub dword [ebp - 0x10], 0xc10c05ff
lea ebx, [ebp - 0x1c]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0xc]
call dword [eax]
push 0x40
push 0x1000
push 0x39737
push 0
call eax
mov ecx, 0x39fecf4f
sub ecx, 0x39fe87d1
xor ebx, ebx
add ebx, eax
mov edx, 0x6bbbd391
add edx, 0x9485dc6f
add edx, dword [ebp - 0xc]
mov edi, 0x37db2d66
add edi, 0x6608c350
mov dword [ebp - 8], 0x5764e737
mov esi, dword [edx]
mov dword [ebp - 4], 0x55948eb6
xor esi, edi
mov dword [ebx], esi
add dword [ebp - 4], 0x2c0107bf
add ebx, 0x74964d70
sub ebx, 0x74964d6c
add edx, 0xfbbbc9dd
add edx, 0x4443627
loop 0x406160
add eax, 0x110cb
xor ebx, ebx
add ebx, eax
add eax, 0x2dc9e2b5
sub eax, 0x2dc9e2b0
mov ecx, 0xe13ceb59
sub ecx, 0xe0fceb59
add ecx, dword [ebp - 0xc]
call ebx
leave
ret

Function at 0x4ca24a
Capabilities:
Encode data using xor

Disassembly:
mov ebx, 0x4c9fca
add edi, ecx
sub edi, edi
call fcn.004ca26b
and edi, ecx
xor dword [eax], ebx
add edi, ecx
inc eax
dec ecx
cmp eax, edx
jne fcn.004ca24a
dec ecx
dec edi
sub ecx, ecx
ret
Function at 0x48b0c3
Capabilities:
Encrypt data using aes

Disassembly:
call fcn.0048b8fe
movsd dword es:[edi], dword [esi]
jmp 0x4b84fc
lea ebx, [ebx*4]
lea edx, [eax + edi]
mov di, ax
jmp 0x48b112
mov dword [esp], ebp
push word [esp + 3]
lea esp, [esp + 2]
jmp 0x48b176
movzx ebx, byte [esi + 0x11]
mov dh, ch
jmp 0x48b156
mov ecx, 0xff
jmp 0x45d144
lea esp, [esp + 0x20]
lea ecx, [eax - 1]
rcl di, cl
mov bx, sp
mov dword [ebp - 4], ecx
jmp 0x48b128
mov ebx, dword [ebx*4 + reloc.KERNEL32.dll_FileTimeToLocalFileTime]
sub esp, 2
lea esp, [esp + 2]
jmp 0x48b1e1
lea esp, [esp + 4]
jle 0x45d0aa
pushal
lea ecx, [eax + edx]
jmp 0x48b144
push edx
mov edi, edx
call 0x48b18f
movsb byte es:[edi], byte [esi]
shr edi, 0x18
call 0x48b198
xlatb
sub esp, 2
call fcn.0048b1f0
push ds
mov esp, 0x43c43552
or dword [ecx + reloc.KERNEL32.dll_FileTimeToLocalFileTime], ecx
test al, 0xcb
bound ebx, qword [ebp - 0x749e0714]
adc byte [eax - 0x73], bl
cmp al, 0x2a
clc
popal
mov edx, dword [eax]
pop eax
lea edi, [edx + ebp]
bsf di, ax
jmp 0x48b186
push eax
pushal
mov di, 0xec81
mov dword [esp + 0x1c], esi
jmp 0x48b1b1
add esi, 0x10
bswap edx
shr dh, 5
mov di, word [esp]
pushal
jmp 0x48b1ca

Function at 0x48b3ff
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
pop word [esp]
mov word [esp], di
jmp 0x48b464
push edx
mov edx, edi
lea edx, [edx*4]
jmp 0x48b492
mov byte [esp + 8], ch
lea esp, [esp + 2]
jmp 0x48b42f
push word [esp + 1]
shr edi, 0x18
sub esp, 0x1e
mov dword [esp + 1], eax
push esp
jmp 0x48b448
mov edi, dword [edi*4 + reloc.KERNEL32.dll_FileTimeToLocalFileTime]
jmp 0x48b49f
lea edx, reloc.KERNEL32.dll_FileTimeToLocalFileTime
mov edi, dword [edx]
pop edx
and edi, ecx
jmp 0x48b476
and ebx, ecx
lea esp, [esp + 0x48]
xor edi, dword [ebx*4 + reloc.KERNEL32.dll_FileTimeToLocalFileTime]
jmp 0x48b8a9
mov edx, dword [ecx]
pop ecx
push esp
sub esp, 8
jmp 0x48b4cb
push ecx
mov ecx, edx
lea ecx, [ecx*4]
lea ecx, reloc.KERNEL32.dll_FileTimeToLocalFileTime
jmp 0x48b4e8
lea esp, [esp + 2]
and edx, ecx
pushal
clc
jmp 0x48b502
xor edi, dword [ebx*4 + reloc.KERNEL32.dll_FileTimeToLocalFileTime]
mov bl, byte [esp]
lea ebx, [ebp*4]
movzx ebx, byte [esi + 9]
sub esp, 0xa
jmp 0x48b559
add esp, 1
lea esp, [esp + 3]
and ebx, ecx
lea esp, [esp + 4]
jmp 0x48b76c
movzx ebx, byte [esi + 6]
push esp
mov ebx, dword [ebx*4 + reloc.KERNEL32.dll_FileTimeToLocalFileTime]
push esp
jmp 0x48b809