joyce8/EMBER2024-capa huggingface dataset:
Function at 0x9308c0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, 0x666015
lea edi, [esi - 0x264015]
push edi
or ebp, 0xffffffff
jmp 0x9308e2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x9308e9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x9308d8
mov eax, 1
add ebx, ebx
jne 0x9308fb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x93090c
jne 0x93092b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x93092b
dec eax
add ebx, ebx
jne 0x930918
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x9308f0
add ebx, ebx
jne 0x930927
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x93097d
xor ecx, ecx
sub eax, 3
jb 0x930943
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x9309b2
sar eax, 1
mov ebp, eax
jmp 0x93094e
add ebx, ebx
jne 0x93094e
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x93091c
inc ecx
add ebx, ebx
jne 0x93095c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x93091c
add ebx, ebx
jne 0x930969
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x93095e
jne 0x93097a
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x93095e
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x93099c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x93098e
jmp 0x9308de
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x93099c
add edi, ecx
jmp 0x9308de
pop esi
mov edi, esi
mov ecx, 2
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x9309ba
mov eax, dword [edi]
mov bl, byte [edi + 4]
xchg ah, al
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x9309bf
lea edi, [esi + 0x52c000]
mov eax, dword [edi]
or eax, eax
je 0x930a27
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x572724]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x572760]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x9309e5
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x572768]
or eax, eax
je 0x930a21
mov dword [ebx], eax
add ebx, 4
jmp 0x930a02
call dword [esi + 0x572764]
mov ebp, dword [esi + 0x57276c]
lea edi, [esi - 0x2000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x19f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x930a5b
sub esp, 0xffffff80
jmp 0x588342
Function at 0x10003026
Capabilities:
Contain obfuscated stackstrings

Disassembly:
imul ecx, dword [ebp - 0x8c]
mov dword [ebp + 0xc], ecx
mov byte [ebp - 0x40], bl
mov byte [ebp - 0x3f], bl
mov byte [ebp - 0x3e], 0xec
mov byte [ebp - 0x3d], bl
mov byte [ebp - 0x3c], 0x45
mov byte [ebp - 0x3b], 0x7a
mov byte [ebp - 0x3a], 0x61
mov byte [ebp - 0x39], 0x67
mov byte [ebp - 0x38], 0x66
mov byte [ebp - 0x37], 0x72
mov byte [ebp - 0x36], 0x7f
mov byte [ebp - 0x35], 0x52
mov byte [ebp - 0x34], 0x7f
mov byte [ebp - 0x33], 0x7f
mov byte [ebp - 0x32], 0x7c
mov byte [ebp - 0x31], 0x70
mov byte [ebp - 0x30], 0x13
inc ebp
rcl byte [ebx]
call fcn.10002d38
js 0x100030d8
call 0xd045be13
push eax
call fcn.10002d48
push eax
push esi
push dword [ebp + 8]
call fcn.10002cfd
add esp, 0x10
mov dword [ebp - 0x88], eax
call fcn.10002d38
pop edi
aam 0x6e
mov dl, 0x8d
inc ebp
call 0x60e88e2e
mov byte [ebp - 0x17], bl
mov byte [ebp - 0x16], 0x40
mov byte [ebp - 0x15], bl
mov byte [ebp - 0x14], 0xe9
mov byte [ebp - 0x13], 0xd6
mov byte [ebp - 0x12], 0xcd
mov byte [ebp - 0x11], 0xcb
mov byte [ebp - 0x10], 0xca
mov byte [ebp - 0xf], 0xde
mov byte [ebp - 0xe], 0xd3
mov byte [ebp - 0xd], 0xf9
mov byte [ebp - 0xc], 0xcd
mov byte [ebp - 0xb], 0xda
mov byte [ebp - 0xa], 0xda
mov byte [ebp - 9], 0xbf
call fcn.10002d48
push eax
push esi
push dword [ebp + 8]
call fcn.10002cfd
mov dword [ebp - 8], eax
lea eax, [ebp - 0x6c]
push eax
mov byte [ebp - 0x6c], bl
mov byte [ebp - 0x6b], bl
mov byte [ebp - 0x6a], 0xbe
mov byte [ebp - 0x69], bl
mov byte [ebp - 0x68], 0x17
mov byte [ebp - 0x67], 0x28
mov byte [ebp - 0x66], 0x33
mov byte [ebp - 0x65], 0x35
mov byte [ebp - 0x64], 0x34
mov byte [ebp - 0x63], 0x20
mov byte [ebp - 0x62], 0x2d
mov byte [ebp - 0x61], 0x11
mov byte [ebp - 0x60], 0x33
mov byte [ebp - 0x5f], 0x2e
mov byte [ebp - 0x5e], 0x35
mov byte [ebp - 0x5d], 0x24
mov byte [ebp - 0x5c], 0x22
mov byte [ebp - 0x5b], 0x35
mov byte [ebp - 0x5a], 0x41
call fcn.10002d48
push eax
push esi
push dword [ebp + 8]
call fcn.10002cfd
mov dword [ebp - 0xbc], eax
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x2c], bl
push eax
mov byte [ebp - 0x2b], bl
mov byte [ebp - 0x2a], 0xd4
mov byte [ebp - 0x29], bl
mov byte [ebp - 0x28], 0x67
mov byte [ebp - 0x27], 0x44
mov byte [ebp - 0x26], 0x4a
mov byte [ebp - 0x25], 0x4f
mov byte [ebp - 0x24], 0x67
mov byte [ebp - 0x23], 0x42
mov byte [ebp - 0x22], 0x49
mov byte [ebp - 0x21], 0x59
mov byte [ebp - 0x20], 0x4a
mov byte [ebp - 0x1f], 0x59
mov byte [ebp - 0x1e], 0x52
mov byte [ebp - 0x1d], 0x6a
mov byte [ebp - 0x1c], 0x2b
call fcn.10002d48
push eax
push esi
push dword [ebp + 8]
call fcn.10002cfd
add esp, 0x30
mov dword [ebp - 0xb8], eax
call fcn.10002d38
jmp 0x9831978c
Function at 0x1000306e
Capabilities:
Contain obfuscated stackstrings

Disassembly:
imul ecx, dword [ebp - 0x8c]
mov dword [ebp + 0xc], ecx
mov byte [ebp - 0x40], bl
mov byte [ebp - 0x3f], bl
mov byte [ebp - 0x3e], 0xec
mov byte [ebp - 0x3d], bl
mov byte [ebp - 0x3c], 0x45
mov byte [ebp - 0x3b], 0x7a
mov byte [ebp - 0x3a], 0x61
mov byte [ebp - 0x39], 0x67
mov byte [ebp - 0x38], 0x66
mov byte [ebp - 0x37], 0x72
mov byte [ebp - 0x36], 0x7f
mov byte [ebp - 0x35], 0x52
mov byte [ebp - 0x34], 0x7f
mov byte [ebp - 0x33], 0x7f
mov byte [ebp - 0x32], 0x7c
mov byte [ebp - 0x31], 0x70
mov byte [ebp - 0x30], 0x13
inc ebp
rcl byte [ebx]
call fcn.10002d38
js 0x100030d8
call 0xd045be13
push eax
call fcn.10002d48
push eax
push esi
push dword [ebp + 8]
call fcn.10002cfd
add esp, 0x10
mov dword [ebp - 0x88], eax
call fcn.10002d38
pop edi
aam 0x6e
mov dl, 0x8d
inc ebp
call 0x60e88e2e
mov byte [ebp - 0x17], bl
mov byte [ebp - 0x16], 0x40
mov byte [ebp - 0x15], bl
mov byte [ebp - 0x14], 0xe9
mov byte [ebp - 0x13], 0xd6
mov byte [ebp - 0x12], 0xcd
mov byte [ebp - 0x11], 0xcb
mov byte [ebp - 0x10], 0xca
mov byte [ebp - 0xf], 0xde
mov byte [ebp - 0xe], 0xd3
mov byte [ebp - 0xd], 0xf9
mov byte [ebp - 0xc], 0xcd
mov byte [ebp - 0xb], 0xda
mov byte [ebp - 0xa], 0xda
mov byte [ebp - 9], 0xbf
call fcn.10002d48
push eax
push esi
push dword [ebp + 8]
call fcn.10002cfd
mov dword [ebp - 8], eax
lea eax, [ebp - 0x6c]
push eax
mov byte [ebp - 0x6c], bl
mov byte [ebp - 0x6b], bl
mov byte [ebp - 0x6a], 0xbe
mov byte [ebp - 0x69], bl
mov byte [ebp - 0x68], 0x17
mov byte [ebp - 0x67], 0x28
mov byte [ebp - 0x66], 0x33
mov byte [ebp - 0x65], 0x35
mov byte [ebp - 0x64], 0x34
mov byte [ebp - 0x63], 0x20
mov byte [ebp - 0x62], 0x2d
mov byte [ebp - 0x61], 0x11
mov byte [ebp - 0x60], 0x33
mov byte [ebp - 0x5f], 0x2e
mov byte [ebp - 0x5e], 0x35
mov byte [ebp - 0x5d], 0x24
mov byte [ebp - 0x5c], 0x22
mov byte [ebp - 0x5b], 0x35
mov byte [ebp - 0x5a], 0x41
call fcn.10002d48
push eax
push esi
push dword [ebp + 8]
call fcn.10002cfd
mov dword [ebp - 0xbc], eax
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x2c], bl
push eax
mov byte [ebp - 0x2b], bl
mov byte [ebp - 0x2a], 0xd4
mov byte [ebp - 0x29], bl
mov byte [ebp - 0x28], 0x67
mov byte [ebp - 0x27], 0x44
mov byte [ebp - 0x26], 0x4a
mov byte [ebp - 0x25], 0x4f
mov byte [ebp - 0x24], 0x67
mov byte [ebp - 0x23], 0x42
mov byte [ebp - 0x22], 0x49
mov byte [ebp - 0x21], 0x59
mov byte [ebp - 0x20], 0x4a
mov byte [ebp - 0x1f], 0x59
mov byte [ebp - 0x1e], 0x52
mov byte [ebp - 0x1d], 0x6a
mov byte [ebp - 0x1c], 0x2b
call fcn.10002d48
push eax
push esi
push dword [ebp + 8]
call fcn.10002cfd
add esp, 0x30
mov dword [ebp - 0xb8], eax
call fcn.10002d38
jmp 0x9831978c
Function at 0x100048b1
Capabilities:
Contain obfuscated stackstrings

Disassembly:
add byte [eax], al
cmp dword [ebp - 0x6fc], 1
jne 0x10004964
and byte [ebp - 0x78c], 0
and byte [ebp - 0x78b], 0
mov byte [ebp - 0x78a], 0xa0
and byte [ebp - 0x789], 0
mov byte [ebp - 0x788], 3
mov byte [ebp - 0x787], 0x3b
mov byte [ebp - 0x786], 0x33
mov byte [ebp - 0x785], 0x3c
mov byte [ebp - 0x784], 0x30
mov byte [ebp - 0x783], 0x3a
mov byte [ebp - 0x782], 0x2d
mov byte [ebp - 0x781], 0x71
mov byte [ebp - 0x780], 0x3b
mov byte [ebp - 0x77f], 0x33
mov byte [ebp - 0x77e], 0x33
mov byte [ebp - 0x77d], 0x5f
push 0xc
lea eax, [ebp - 0x78c]
push eax
call fcn.10002d48
pop ecx
push eax
mov eax, dword [ebp - 0x28]
lea eax, [ebp + eax - 0x12c]
add eax, 0xfffffed4
push eax
call fcn.10002ca9
add esp, 0xc
lea eax, [ebp - 0x12c]
mov dword [ebp - 0x3a0], eax
jmp 0x10004cb0
cmp dword [ebp - 0x6fc], 2
jne 0x10004a21
and byte [ebp - 0x79c], 0
and byte [ebp - 0x79b], 0
mov byte [ebp - 0x79a], 0x10
and byte [ebp - 0x799], 0
mov byte [ebp - 0x798], 0xb3
mov byte [ebp - 0x797], 0x8c
mov byte [ebp - 0x796], 0x80
mov byte [ebp - 0x795], 0x81
mov byte [ebp - 0x794], 0x9d
mov byte [ebp - 0x793], 0x8a
mov byte [ebp - 0x792], 0x9c
mov byte [ebp - 0x791], 0xc1
mov byte [ebp - 0x790], 0x8b
mov byte [ebp - 0x78f], 0x83
mov byte [ebp - 0x78e], 0x83
clc
invalid
inc dword [ebx - 0x78c7a3a]
invalid
invalid
out dx, eax
call fcn.10002d38
pop esp
or al, 0xa4
cmpsd dword [esi], dword es:[edi]
push 0xc
lea eax, [ebp - 0x79c]
push eax
call fcn.10002d48
pop ecx
push eax
mov eax, dword [ebp - 0x550]
lea eax, [ebp + eax - 0x654]
push eax
call fcn.10002ca9
add esp, 0xc
lea eax, [ebp - 0x654]
mov dword [ebp - 0x3a0], eax
jmp 0x10004cb0
cmp dword [ebp - 0x6fc], 3
jne 0x10004ac2
and byte [ebp - 0x7ac], 0
and byte [ebp - 0x7ab], 0
mov byte [ebp - 0x7aa], 0xed
and byte [ebp - 0x7a9], 0
mov byte [ebp - 0x7a8], 0x4e
mov byte [ebp - 0x7a7], 0x55
mov byte [ebp - 0x7a6], 0x56
mov byte [ebp - 0x7a5], 0x7e
mov byte [ebp - 0x7a4], 0x21
mov byte [ebp - 0x7a3], 0x20
mov byte [ebp - 0x7a2], 0x3c
mov byte [ebp - 0x7a1], 0x76
mov byte [ebp - 0x7a0], 0x7e
mov byte [ebp - 0x79f], 0x7e
mov byte [ebp - 0x79e], 0x12
push 0xb
lea eax, [ebp - 0x7ac]
push eax
call fcn.10002d48
pop ecx
push eax
mov eax, dword [ebp - 0x338]
lea eax, [ebp + eax - 0x230]
push eax
call fcn.10002ca9
add esp, 0xc
jmp 0x10004cb0
cmp dword [ebp - 0x6fc], 4
jne 0x10004b6c
and byte [ebp - 0x7bc], 0
and byte [ebp - 0x7bb], 0
mov byte [ebp - 0x7ba], 2
and byte [ebp - 0x7b9], 0
mov byte [ebp - 0x7b8], 0xa1
mov byte [ebp - 0x7b7], 0xb2
mov byte [ebp - 0x7b6], 0xb1
mov byte [ebp - 0x7b5], 0xb8
mov byte [ebp - 0x7b4], 0xcf
mov byte [ebp - 0x7b3], 0xce
mov byte [ebp - 0x7b2], 0xd3
mov byte [ebp - 0x7b1], 0x99
mov byte [ebp - 0x7b0], 0x91
invalid
test dword [ecx - 8], edx
Function at 0x10004557
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x10004596
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x10004596
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x10004596
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x10004596
cmp dword [ecx + 0x74], 0xe
jbe 0x10004596
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x1000721f
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x100072bc
push ebx
push esi
call fcn.100071e8
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.1000717c
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x10007269
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x100072bb
push edi
push eax
call fcn.100081da
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x10007289
call fcn.10005cc4
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x100072ba
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.1000717c
add esp, 0x20
test eax, eax
jne 0x100072a8
push edi
call fcn.10005cc4
jmp 0x100072b0
push ebx
call fcn.10005cc4
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x10007529
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x1000e4e8
push 0x1000e4e0
push str.FlsAlloc
push 0x1f
call fcn.10007445
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1000755d
push dword [ebp + 8]
mov ecx, esi
call dword [0x1000d110]
call esi
jmp 0x10007563
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x100075a7
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x1000e4f8
push 0x1000e4f0
push str.FlsGetValue
push 0x21
call fcn.10007445
mov esi, eax
add esp, 0x10
test esi, esi
je 0x100075de
push dword [ebp + 8]
mov ecx, esi
call dword [0x1000d110]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x100075e6
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x1000e500
push 0x1000e4f8
push str.FlsSetValue
push 0x22
call fcn.10007445
mov esi, eax
add esp, 0x10
test esi, esi
je 0x10007620
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x1000d110]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x1000cca0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x1000cccd
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1000cccd
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x146a490
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0xac1000]
push edi
jmp 0x146a4aa
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x146a4b1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x146a4a0
mov eax, 1
add ebx, ebx
jne 0x146a4c3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x146a4d4
jne 0x146a4f3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x146a4f3
dec eax
add ebx, ebx
jne 0x146a4e0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x146a4b8
add ebx, ebx
jne 0x146a4ef
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x146a545
xor ecx, ecx
sub eax, 3
jb 0x146a50b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x146a57a
sar eax, 1
mov ebp, eax
jmp 0x146a516
add ebx, ebx
jne 0x146a516
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x146a4e4
inc ecx
add ebx, ebx
jne 0x146a524
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x146a4e4
add ebx, ebx
jne 0x146a531
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x146a526
jne 0x146a542
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x146a526
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x146a564
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x146a556
jmp 0x146a4a6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x146a564
add edi, ecx
jmp 0x146a4a6
pop esi
mov edi, esi
mov ecx, 0x42517
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x146a582
mov eax, dword [edi]
mov bl, byte [edi + 4]
xchg ah, al
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x146a587
lea edi, [esi + 0x1033000]
mov eax, dword [edi]
or eax, eax
je 0x146a5ef
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x10b2864]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x10b28a8]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x146a5ad
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x10b28b0]
or eax, eax
je 0x146a5e9
mov dword [ebx], eax
add ebx, 4
jmp 0x146a5ca
call dword [esi + 0x10b28ac]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x146a620
cmp al, 0xef
ja 0x146a613
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x146a5f5
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x146a602
mov ebp, dword [esi + 0x10b28b4]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x277]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x146a654
sub esp, 0xffffff80
jmp 0x7ce9e3
Function at 0x408938
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x4085d8
add ebx, ebx
call fcn.00408953
xor dword [edx], eax
inc edx
push ebx
pop ebx
add ebx, esi
cmp edx, edi
jne fcn.00408938
inc ebx
ret
Function at 0x48ea10
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x89000]
push edi
jmp 0x48ea2a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x48ea31
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x48ea20
mov eax, 1
add ebx, ebx
jne 0x48ea43
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x48ea54
jne 0x48ea73
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x48ea73
dec eax
add ebx, ebx
jne 0x48ea60
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x48ea38
add ebx, ebx
jne 0x48ea6f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x48eac5
xor ecx, ecx
sub eax, 3
jb 0x48ea8b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x48eafa
sar eax, 1
mov ebp, eax
jmp 0x48ea96
add ebx, ebx
jne 0x48ea96
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x48ea64
inc ecx
add ebx, ebx
jne 0x48eaa4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x48ea64
add ebx, ebx
jne 0x48eab1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x48eaa6
jne 0x48eac2
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x48eaa6
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x48eae4
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x48ead6
jmp 0x48ea26
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x48eae4
add edi, ecx
jmp 0x48ea26
pop esi
mov edi, esi
mov ecx, 0x2aa
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x48eb02
cmp byte [edi], 2
jne 0x48eb02
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x48eb07
lea edi, [esi + 0x8c000]
mov eax, dword [edi]
or eax, eax
je 0x48eb7f
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x9070c]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x907c0]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x48eb34
mov ecx, edi
jns 0x48eb63
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x907c4]
or eax, eax
je 0x48eb79
mov dword [ebx], eax
add ebx, 4
jmp 0x48eb51
call dword [esi + 0x907d4]
mov ebp, dword [esi + 0x907c8]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1ef]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x48ebb3
sub esp, 0xffffff80
jmp 0x40356f
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x408ecc
nop
nop
mov ecx, 0x42af1823
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x43004e
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x430024
nop
nop
nop
mov eax, section..data
nop
nop
mov ebx, 0x42e1d0
nop
mov ecx, 0x45f556af
nop
nop
test eax, eax
nop
nop
nop
je 0x430084
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x43006c
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x401219
Function at 0x409a9f
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push esi
push edi
mov edi, dword [ebp + 8]
push 0
push eax
push dword [edi + 0x14]
push dword [ebp + 0xc]
call fcn.00407303
mov esi, eax
test esi, esi
jns 0x409aca
push str.Failed_to_format_variable_string.
jmp 0x409b44
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov edx, eax
cmp edx, 0xffffffff
jne 0x409b05
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x409aef
movzx esi, si
or esi, 0x80070000
cmp esi, 0x80070002
je 0x409aff
cmp esi, 0x80070003
jne 0x409b01
xor esi, esi
xor eax, eax
jmp 0x409b0f
xor eax, eax
xor ecx, ecx
test dl, 0x10
je 0x409b11
inc eax
xor ecx, ecx
test esi, esi
jns 0x409b2a
push dword [ebp - 4]
push dword [edi]
push str.Failed_while_searching_directory_search:__ls__for_path:__ls
push esi
call fcn.0043fb09
add esp, 0x10
jmp 0x409b4c
push 0
push ecx
push eax
push dword [edi + 4]
push dword [ebp + 0xc]
call fcn.00408274
mov esi, eax
test esi, esi
jns 0x409b4c
invalid
invalid

Function at 0x409b5c
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push esi
push edi
mov edi, dword [ebp + 8]
push 0
push eax
push dword [edi + 0x14]
push dword [ebp + 0xc]
call fcn.00407303
mov esi, eax
test esi, esi
jns 0x409b92
push str.Failed_to_format_variable_string.
push esi
call fcn.0043fb09
pop ecx
pop ecx
jmp 0x409c1d
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x409bb7
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x409bdd
movzx esi, si
or esi, 0x80070000
jmp 0x409bdd
test al, 0x10
je 0x409bd8
push 0
push dword [ebp - 4]
push dword [edi + 4]
push dword [ebp + 0xc]
call fcn.0040821a
mov esi, eax
test esi, esi
jns 0x409bdd
push str.Failed_to_set_directory_search_path_variable.
jmp 0x409b85
mov esi, 0x80070003
cmp esi, 0x80070002
je 0x409c06
cmp esi, 0x80070003
je 0x409c06
test esi, esi
jns 0x409c1d
push dword [ebp - 4]
push dword [edi]
push str.Failed_while_searching_directory_search:__ls__for_path:__ls
push esi
call fcn.0043fb09
add esp, 0x10
jmp 0x409c1d
push esi
push dword [ebp - 4]
push dword [edi]
push str.Directory_search:__ls__did_not_find_path:__ls__reason:_0x_x
push 2
call fcn.0043fff0
add esp, 0x14
xor esi, esi
push dword [ebp - 4]
call fcn.0040287d
pop edi
mov eax, esi
pop esi
leave
ret 8