joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4066aa
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x40e440]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00404510
and dword [ebp - 0x14], 0
cmp dword [0x40f868], 0
mov dword [ebp - 0x18], eax
jne 0x40675d
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x406805
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x406805
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x40f868], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x40f86c], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x40f870], eax
call edi
push eax
call esi
mov dword [0x40f878], eax
test eax, eax
je 0x40675d
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x40f874], eax
mov eax, dword [0x40f874]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x4067b6
cmp dword [0x40f878], ecx
je 0x4067b6
push eax
call esi
push dword [0x40f878]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x4067b6
test ebx, ebx
je 0x4067b6
call edi
test eax, eax
je 0x4067ad
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x4067ad
test byte [ebp - 8], 1
jne 0x4067b6
or dword [ebp + 0x10], 0x200000
jmp 0x4067e9
mov eax, dword [0x40f86c]
cmp eax, dword [ebp - 0x18]
je 0x4067e9
push eax
call esi
test eax, eax
je 0x4067e9
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x4067e9
mov eax, dword [0x40f870]
cmp eax, dword [ebp - 0x18]
je 0x4067e9
push eax
call esi
test eax, eax
je 0x4067e9
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x40f868]
call esi
test eax, eax
je 0x406805
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x406807
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00405da8
leave
ret
Function at 0x401271
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
sub esp, 0x1c
push esi
push ecx
pop esi
sub ecx, ecx
mov edx, dword [esi + 0x3c]
mov dword [eax], ecx
mov eax, dword [ebp + 0x10]
add edx, esi
mov dword [eax], ecx
mov eax, 0x14c
push edi
push ecx
pop edi
cmp word [edx + 4], ax
jne 0x4013b8
push ebx
mov ebx, dword [edx + 0x88]
mov dword [ebp - 0x14], ebx
or ebx, ebx
je 0x4013b7
cmp dword [edx + 0x8c], ecx
je 0x4013b7
movzx eax, word [edx + 0x14]
add eax, 0x18
add eax, edx
movzx edx, word [edx + 6]
or edx, edx
je 0x4013b7
cmp dword [eax + 0xc], ebx
je 0x4012e2
inc ecx
add eax, 0x28
cmp ecx, edx
jb 0x4012d0
jmp 0x4013b7
mov edx, dword [eax + 0x14]
add edx, esi
push 0
movzx ecx, word [edx + 0xe]
movzx eax, word [edx + 0xc]
add ecx, eax
mov dword [ebp - 0x10], edx
mov dword [ebp - 0x1c], ecx
pop ebx
je 0x4013b7
xor eax, eax
mov esi, dword [edx + eax*8 + 0x14]
and esi, 0x7fffffff
add esi, edx
push 0
movzx ecx, word [esi + 0xe]
movzx eax, word [esi + 0xc]
add ecx, eax
mov dword [ebp - 0x18], ecx
pop ecx
mov dword [ebp - 0xc], ecx
je 0x4013aa
xor eax, eax
cmp word [esi + eax*8 + 0x10], 0x65
jne 0x40139a
mov ecx, dword [esi + eax*8 + 0x14]
and ecx, 0x7fffffff
add ecx, edx
mov dword [ebp - 8], 0
movzx eax, word [ecx + 0xe]
mov dword [ebp - 4], eax
movzx eax, word [ecx + 0xc]
add dword [ebp - 4], eax
je 0x401393
sub eax, eax
mov edx, 0x409
cmp word [ecx + eax*8 + 0x10], dx
mov edx, dword [ebp - 0x10]
je 0x401376
mov eax, dword [ebp - 8]
inc eax
mov dword [ebp - 8], eax
movzx eax, ax
cmp eax, dword [ebp - 4]
jb 0x401356
jmp 0x401393
mov ecx, dword [ecx + eax*8 + 0x14]
mov edi, dword [ebp + 0xc]
mov eax, dword [ecx + edx]
sub eax, dword [ebp - 0x14]
add eax, edx
mov dword [edi], eax
mov eax, dword [ecx + edx + 4]
mov ecx, dword [ebp + 0x10]
sub edi, edi
mov dword [ecx], eax
inc edi
or edi, edi
jne 0x4013b7
mov ecx, dword [ebp - 0xc]
inc ecx
movzx eax, cx
mov dword [ebp - 0xc], ecx
cmp eax, dword [ebp - 0x18]
jb 0x401329
or edi, edi
jne 0x4013b7
inc ebx
movzx eax, bx
cmp eax, dword [ebp - 0x1c]
jb 0x401302
pop ebx
mov eax, edi
pop edi
pop esi
leave
ret 0xc

Function at 0x4013c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push esp
pop ebp
push ebx
push esi
push edi
mov edi, edx
mov ebx, edi
shr ebx, 2
and edi, 3
mov esi, ecx
test ebx, ebx
je 0x4013f3
mov al, byte [ebp + 0xc]
mov edx, dword [esi]
add al, bl
movzx ecx, al
mov eax, dword [ebp + 8]
ror edx, cl
xor edx, eax
sub edx, ebx
mov dword [esi], edx
add esi, 4
dec ebx
jne 0x4013d6
jmp 0x4013f6
mov eax, dword [ebp + 8]
test edi, edi
je 0x401400
xor byte [esi], al
inc esi
dec edi
jne 0x4013fa
pop edi
pop esi
pop ebx
pop ebp
ret 0xc

Function at 0x401407
Capabilities:
Terminate process

Disassembly:
push ebx
mov eax, 0xff35
mov ebx, 0x12345678
mov ecx, 0x12345678
mov edx, 0x12345678
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov dword [section..data], eax
jmp loc.0047950e
Function at 0x401069
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x816030]
jne 0x401073
repz ret
jmp fcn.00401e51

Function at 0x408b0b
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00404d5a
and dword [ebp - 4], 0
cmp dword [0x818b68], 0
mov ebx, eax
jne 0x408bbc
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x408c6d
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x408c6d
push eax
call fcn.00404ce8
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x818b68], eax
call esi
push eax
call fcn.00404ce8
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x818b6c], eax
call esi
push eax
call fcn.00404ce8
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x818b70], eax
call esi
push eax
call fcn.00404ce8
pop ecx
mov dword [0x818b78], eax
test eax, eax
je 0x408bbc
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00404ce8
pop ecx
mov dword [0x818b74], eax
mov eax, dword [0x818b74]
cmp eax, ebx
je 0x408c14
cmp dword [0x818b78], ebx
je 0x408c14
push eax
call fcn.00404d63
push dword [0x818b78]
mov esi, eax
call fcn.00404d63
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x408c14
test edi, edi
je 0x408c14
call esi
test eax, eax
je 0x408c0b
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x408c0b
test byte [ebp - 0xc], 1
jne 0x408c14
or dword [ebp + 0x10], 0x200000
jmp 0x408c4d
mov eax, dword [0x818b6c]
cmp eax, ebx
je 0x408c4d
push eax
call fcn.00404d63
pop ecx
test eax, eax
je 0x408c4d
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x408c4d
mov eax, dword [0x818b70]
cmp eax, ebx
je 0x408c4d
push eax
call fcn.00404d63
pop ecx
test eax, eax
je 0x408c4d
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x818b68]
call fcn.00404d63
pop ecx
test eax, eax
je 0x408c6d
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x408c6f
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x40af60
Capabilities:
Set console window title

Disassembly:
sub esp, 0x820
mov eax, dword [0x816030]
xor eax, esp
mov dword [esp + 0x81c], eax
mov eax, dword [0x2ff655c]
push ebx
mov ebx, dword [0x2ff6280]
push esi
mov esi, dword [0x816f60]
push edi
mov edi, eax
cmp eax, 0x930
jne 0x40afa1
push str.zolihetujejijitewi
call dword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
mov eax, dword [0x2ff655c]
mov dword [0x818d0c], esi
cmp eax, 0x114e
jne 0x40afcb
lea eax, [esp + 0xc]
push eax
push str.Gijetuhe_batawuwafadis_fomikayemes_zeruru
call dword [sym.imp.KERNEL32.dll_BuildCommDCBW]
push 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov eax, dword [0x2ff655c]
cmp eax, 0x2f
jne 0x40afeb
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumTimeFormatsW]
push 0
lea ecx, [esp + 0x2c]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_FindNextVolumeMountPointW]
call fcn.0040ae60
mov ecx, dword [esp + 0x828]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00401069
add esp, 0x820
ret
Function at 0x407e15
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42e180]
jne 0x407e1f
repz ret
jmp fcn.0040bc0c

Function at 0x420ed5
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
pushal
call 0x420ee4
pop dword [ebp - 0x20]
mov eax, 0xed006f90
add eax, 0x13419f54
sub dword [ebp - 0x20], eax
mov dword [ebp - 0x30], 0xef069add
sub dword [ebp - 0x30], 0xa0b45592
mov dword [ebp - 0x2c], 0xe8e1c085
add dword [ebp - 0x2c], 0x49518bc0
mov dword [ebp - 0x28], 0x6c298db8
add dword [ebp - 0x28], 0xe022b676
mov dword [ebp - 0x24], 0x44df1c49
sub dword [ebp - 0x24], 0x44df1c49
lea eax, [ebp - 0x30]
push eax
mov eax, 0x2aefa45d
sub eax, 0x2aad73e9
add eax, dword [ebp - 0x20]
call dword [eax]
mov dword [ebp - 0x30], 0x4aae6a7a
sub dword [ebp - 0x30], 0xd63c0124
mov dword [ebp - 0x2c], 0xba4b9283
add dword [ebp - 0x2c], 0x8720cef2
mov dword [ebp - 0x28], 0x241584a3
add dword [ebp - 0x28], 0x3f59e7c9
mov dword [ebp - 0x24], 0x21cab1e4
add dword [ebp - 0x24], 0xde354e1c
lea ebx, [ebp - 0x30]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x20]
call dword [eax]
push 0x40
push 0x1000
push 0x3f02c
push 0
call eax
mov ecx, 0x27f9abf7
sub ecx, 0x27f95eef
xor edi, edi
add edi, eax
mov ebx, 0x434400
add ebx, dword [ebp - 0x20]
mov edx, 0x3365cb54
mov dword [ebp - 0xc], 0xa5e65cc
mov esi, dword [ebx]
sub dword [ebp - 8], esi
xor esi, edx
xor dword [ebp - 4], 0x4774d6c2
mov dword [edi], esi
add dword [ebp - 0x18], ecx
add edi, 0x8b7d1bf1
add edi, 0x7482e413
add ebx, 0x1993e377
add ebx, 0xe66c1c8d
loop 0x420ff7
add eax, 0xf3e4d484
add eax, 0xc1c526f
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x83c6e8e0
add ecx, 0x7c791720
add ecx, dword [ebp - 0x20]
call ebx
leave
ret

Function at 0x431003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
call 0x43100c
nop
nop
nop
pop eax
nop
nop
nop
add eax, 0x403e6a
nop
sub eax, 0x403e10
nop
nop
nop
mov ebx, dword [eax]
nop
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
add ebx, 4
nop
nop
nop
nop
nop
nop
cmp ebx, ecx
jl 0x431030
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
jne 0x43101e
nop
nop
nop
nop
nop
nop
nop
popal
jmp fcn.00401219
Function at 0x403523
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [ebp + 8]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ecx + 0x3c]
add edx, dword [ebp + 8]
mov dword [ebp - 0x18], edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x18]
mov edx, dword [ecx + 0x78]
push edx
call fcn.00403518
add esp, 8
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx + 0x20]
push edx
call fcn.00403518
add esp, 8
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx + 0x24]
push edx
call fcn.00403518
add esp, 8
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx + 0x1c]
push edx
call fcn.00403518
add esp, 8
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], 0
jmp 0x4035a5
mov eax, dword [ebp - 0xc]
add eax, 1
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0xc]
cmp edx, dword [ecx + 0x18]
jae 0x403600
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 4]
mov eax, dword [edx + ecx*4]
push eax
call fcn.00403518
add esp, 8
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp - 0x20]
push edx
call fcn.0040348c
add esp, 8
test eax, eax
jne 0x4035fe
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 8]
xor eax, eax
mov ax, word [edx + ecx*2]
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx + eax*4]
push edx
call fcn.00403518
add esp, 8
jmp 0x403602
jmp 0x40359c
xor eax, eax
mov esp, ebp
pop ebp
ret 8
Function at 0x403608
Capabilities:
Authenticate hmac

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push edx
lea dx, [esp + 0xf2]
shl dl, cl
test dx, 0x7e2e
pop edx
call fcn.004042f1
cmovne esi, esi
popfd
dec esp
cmpsb byte [esi], byte es:[edi]
xor byte [ebx], ah
sbb dl, byte [ebp + 0x451f95ea]
sti
fmulp st(7)
arpl ax, si
mov cl, 0x5c
pop ebp
inc eax
jb 0x4036ab
invalid
pop ecx
push edi
push esi
and dword [eax + 0x7577f57c], edi
je 0x403719
xchg edi, eax
dec ecx
sub ah, byte [ebp - 0x6ba25d5d]
dec eax
sub eax, 0x81a2a3a5
out dx, eax
and dword [edx - 0x31], ebx
int 0xcc
retf
invalid
add al, byte [edi - 0x370a090a]
sbb eax, 0x282856d3
daa
push ss
ja 0x4036d1
sub dl, byte [ebp + 0x53]
push edx
sub dword [ebx - 0x7b], eax
clc
add byte [eax + 0x4c88787f], 0xc1
mov eax, 0xdb86b7b8
sbb eax, 0xe9eaea94
xchg esp, eax
leave
je 0x8393144
div dword [eax - 0xb]
jns 0x4037c5
jbe 0x4037b9
mov ecx, 0xaaaaae0d
or bl, byte [edx - 0x60606494]
lahf
adc al, 0x51
or eax, 0x6be10a0b
inc ecx
mov dl, 0xbf
mov bh, 0xb4
mov bl, 0xaa
jecxz 0x4037b8
sbb dword [ebp - 0x2c867d7d], eax
add dl, byte [edi + 7]
add eax, 0xf2af304
stosd dword es:[edi], eax
test eax, 0x575757a8
push edi
xchg dword [edx + 0x59], edx
enter 0xdad, 0xb
or dh, cl
jb 0x40373c
mov eax, dword [0xb5b71b26]
mov ah, 0x4b
mov dh, 0xf3
dec edi
dec ebp
dec esp
mov bl, 0x7d
insb byte es:[edi], dx
out dx, eax
and esp, dword [ebx]
and edx, dword [ebx]
xchg bl, dh
dec edi
dec ebp
dec esp
stosd dword es:[edi], eax
pop eax
invalid
pop edi
pop esp
pop ebx
adc al, 0x44
inc esp
js 0x4037bc
into
retf
in eax, dx
and edx, dword [esi]
push ss
and esp, dword es:[edx]
ror dword [esi], 0xc6
mov ebx, 0x7586878a
lcall 0xf0f3, 0xf4f7d752
jne 0x40376c
push edx
xlatb
div esp
invalid
div byte ds:[ebx + 0x58]
pop ecx
pop eax
pop ss
push ebx
xchg ebp, eax
in al, dx
mov esp, 0xe8bbbcbd
sub al, 5
and al, 0x25
and al, 0xdb
adc cl, dl
scasd eax, dword es:[edi]
add dword [eax + 0x74b0787f], 0xffffffc9
loop 0x4037d8
ficomp word [ebp + 0x4d7b06ce]
dec esi
dec ebp
or dl, byte [esi - 0x72]
jecxz 0x4037d0
mov esi, 0x34418f25
adc cl, byte [edi]
push cs
in eax, dx
cmp edi, ebp
inc esi
pop edi
pop esp
pop ebx
push eax
jb 0x4037c3
invalid

Function at 0x4058a3
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
lea eax, [ebp - 0x10]
mov dword [0x430250], 0x44
push eax
xor eax, eax
push 0x430250
push eax
push eax
push 0x4000000
push eax
push eax
push eax
push dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x4058e2
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x10]
leave
ret 4

Function at 0x4058e6
Capabilities:
Create process on windows

Disassembly:
mov eax, dword [esp + 4]
push eax
and dword [eax + 0x24], 0
mov dword [eax], 0x3c
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
ret 4
Function at 0x405984
Capabilities:
Delete directory
Delete file
Set file attributes

Disassembly:
push esi
mov esi, dword [esp + 8]
push edi
push esi
call fcn.00405d8b
mov edi, eax
cmp edi, 0xffffffff
je 0x4059c5
test byte [esp + 0x10], 1
push esi
je 0x4059a7
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
jmp 0x4059ad
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x4059b6
xor eax, eax
inc eax
jmp 0x4059c7
test byte [esp + 0x10], 4
jne 0x4059c5
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
xor eax, eax
pop edi
pop esi
ret 8

Function at 0x4059cc
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x258
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
mov eax, ebx
and eax, 4
push edi
mov dword [ebp - 4], eax
call fcn.00405c97
test bl, 8
mov dword [ebp - 8], eax
je 0x405a0b
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
neg eax
sbb eax, eax
inc eax
add dword [0x434f88], eax
jmp 0x405b88
mov dword [ebp + 8], ebx
and dword [ebp + 8], 1
je 0x405a25
test eax, eax
je 0x405b36
test bl, 2
je 0x405b36
mov esi, 0x42f250
push edi
push esi
call fcn.004062ba
cmp dword [ebp + 8], 0
je 0x405a44
push str..
push esi
call sub.KERNEL32.dll_lstrcatW
jmp 0x405a4a
push edi
call fcn.00405bdb
cmp word [edi], 0
jne 0x405a5a
cmp word [0x42f250], 0x5c
jne 0x405a65
push 0x40a014
push edi
call sub.KERNEL32.dll_lstrcatW
push edi
call sub.KERNEL32.dll_lstrlenW
lea ebx, [edi + eax*2]
lea eax, [ebp - 0x258]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x405b2b
cmp word [ebp - 0x22c], 0x2e
jne 0x405aaf
cmp word [ebp - 0x22a], 0
je 0x405b0e
cmp word [ebp - 0x22a], 0x2e
jne 0x405aaf
cmp word [ebp - 0x228], 0
je 0x405b0e
lea eax, [ebp - 0x22c]
push eax
push ebx
call fcn.004062ba
test byte [ebp - 0x258], 0x10
je 0x405ada
mov eax, dword [ebp + 0xc]
and eax, 3
cmp al, 3
jne 0x405b0e
push dword [ebp + 0xc]
push edi
call fcn.004059cc
jmp 0x405b0e
push dword [ebp - 4]
push edi
call fcn.00405984
test eax, eax
jne 0x405b06
cmp dword [ebp - 4], eax
je 0x405afe
push edi
push 0xfffffffffffffff1
call fcn.00405322
push 0
push edi
call fcn.00406080
jmp 0x405b0e
inc dword [0x434f88]
jmp 0x405b0e
push edi
push 0xfffffffffffffff2
call fcn.00405322
lea eax, [ebp - 0x258]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x405a87
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp dword [ebp + 8], 0
je 0x405b36
and word [ebx - 2], 0
xor esi, esi
cmp dword [ebp + 8], esi
je 0x405b88
cmp dword [ebp - 8], esi
jne 0x405b4a
inc dword [0x434f88]
jmp 0x405b88
push edi
call fcn.004065fd
test eax, eax
je 0x405b88
push edi
call fcn.00405b8f
mov eax, dword [ebp - 4]
or al, 1
push eax
push edi
call fcn.00405984
test eax, eax
jne 0x405b80
cmp dword [ebp - 4], esi
je 0x405b42
push edi
push 0xfffffffffffffff1
call fcn.00405322
push esi
push edi
call fcn.00406080
jmp 0x405b88
push edi
push 0xffffffffffffffe5
call fcn.00405322
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x10073770
Capabilities:
Packed with generic packer

Disassembly:
cmp byte [esp + 8], 1
jne 0x1007390c
pushal
mov esi, section.UPX1
lea edi, [esi - 0x63000]
push edi
or ebp, 0xffffffff
jmp 0x1007379a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x100737a1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x10073790
mov eax, 1
add ebx, ebx
jne 0x100737b3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x100737c4
jne 0x100737d4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x100737d4
dec eax
add ebx, ebx
jne 0x100737d0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x100737a8
xor ecx, ecx
sub eax, 3
jb 0x100737ec
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x1007385e
sar eax, 1
mov ebp, eax
jmp 0x100737f7
add ebx, ebx
jne 0x100737f7
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x10073804
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x10073828
inc ecx
add ebx, ebx
jne 0x10073814
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x10073809
jne 0x10073825
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x10073809
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x10073848
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x10073839
jmp 0x10073796
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x10073848
add edi, ecx
jmp 0x10073796
pop esi
mov edi, esi
mov ecx, 0x81f
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x10073866
cmp byte [edi], 0xa
jne 0x10073866
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov eax, ebx
loop 0x1007386b
lea edi, [esi + 0x70000]
mov eax, dword [edi]
or eax, eax
je 0x100738da
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x732a0]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x732f0]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x10073898
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x732f4]
or eax, eax
je 0x100738d4
mov dword [ebx], eax
add ebx, 4
jmp 0x100738b5
popal
xor eax, eax
ret 0xc
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x1007390b
cmp al, 0xef
ja 0x100738fe
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x100738e0
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x100738ed
popal
jmp 0x1000f08d
Function at 0x46c948
Capabilities:
Encode data using xor

Disassembly:
and al, 0x31
push edx
pop ebp
std
and dl, dh
sub esp, dword [esi - 0x11ca298f]
push esp
mov al, byte [0x9c5276c1]
xchg esi, eax
call dword [ecx - 0x4f40c21a]
xlatb
or eax, 0x99f3b046
and edx, ebx
scasb al, byte es:[edi]
and ebx, ebp
xchg esi, eax
jmp 0x46c992
lea esi, [eax - 0x3e]
jo 0x46c907
scasb al, byte es:[edi]
bound eax, qword [esi - 0x579a9ef0]
adc byte [ecx + 0x65], ah
test al, 0x85
pop es
adc byte [ecx + 0x65], ah
test al, 0x85
pop es
xor ebx, dword [0x93d72fd2]
sub al, 0xe0
or ebx, dword [edx - 0x524c5ba4]
pop esp
movsb byte es:[edi], byte [esi]
mov bl, 0xad
xchg esp, eax
lahf
push es
salc
in al, 0x76
fmul dword [eax]
inc eax
jo 0x46c942
dec edi
out dx, al
and esi, dword [0xb7921773]
mov edi, 0xf79797a6
sahf
loope 0x46c943
mov ecx, 0xb7347b48
jg 0x46c992
dec edx
push edi
ror dword [ebx + 0x1c3a5446], 1
pop edi
push cs
add edx, dword [ebx]
outsb dx, byte [esi]
fmulp st(7)
pushal
ret

Function at 0x4822a8
Capabilities:
Encode data using xor

Disassembly:
push es
loopne 0x4822e5
pop edi
push ebx
xlatb
inc esi
out 0x27, al
cmpsb byte [esi], byte es:[edi]
xor al, 0x49
adc esi, dword [esi]
or esi, dword [ebx]
cmp al, 0xa1
mov edi, 0xba47b9b6
not byte [ecx + eax*8 + 0x50]
aas
cmp dword [esi + 0x6e], edx
mov edx, 0x7da1d453
aaa
add dword [ecx], ebp
push cs
test dword [edx + 0x63], ebx
xor ecx, esi
sar dword [ecx - 0x26f2fb50], cl
and ah, ah
mov al, byte [0xabe55284]
sti
sub ch, byte [ebx]
xor al, 0x56
sub esi, dword [esi + edx*2]
imul ebp, dword [ecx], 0xffffff92
in eax, 0x73
pop esp
cmp al, 0x16
invalid

Function at 0x4824d9
Capabilities:
Encode data using xor

Disassembly:
add dword [ecx], ecx
sal dword [edi + 0x2262c2bc], cl
aam 0x60
or dword [edi - 0x71cbf1bc], 0xffffffd8
inc edi
pop ebx
dec byte [0xaa56b225]
stosb byte es:[edi], al
popal
stosd dword es:[edi], eax
sbb dword [ebx - 0x6e], eax
scasd eax, dword es:[edi]
wait
pop ss
in al, 6
in al, 0xfb
dec eax
clc
and esi, dword [esi]
mov esi, 0xd7058096
inc ebx
pop esi
cmp al, 0xa5
xor dl, dh
sub dword [esi + 0x46835533], 0xffffff9e
loope 0x482450
add al, 0x21
test byte [eax], bh
daa
fsubr st(1)
mov bl, 0xe3
sbb si, word [eax + 0x3c]
outsb dx, byte [esi]
xchg dword [ecx + 0x3d2ab0d7], esi
and byte [ebp - 0x68], dl
pushal
push ebx
sbb eax, 0xf007e2b8
fisubr dword [esi + 0x24]
outsb dx, byte [esi]
or ebx, ecx
in al, dx
push eax
mov bl, 0xba
xchg esp, eax
adc eax, 0x7acab50
pop ss
mov byte [0x724eff2b], al
push ds
pushal
push esi
sbb eax, 0xe612c686
and dl, byte [esi - 0x7b]
ljmp 0x62df
loopne 0x482468
cmpsb byte [esi], byte es:[edi]
xor al, byte [esi + 0x747784f2]
jg 0x4824e9
pop edx
dec ebx
wait
inc esp
pop es
rcr byte [ebp - 0x28], cl
mov ch, 0x26
adc eax, 0xcdd063cf
in al, 0xc
xlatb
pop edx
and al, byte [ebx + 0x23a27ccf]
jb 0x482504
das
sahf
retf
sub eax, 0xaa541d17
xchg edi, eax
add ebp, dword [edi + 0x32]
push ebx
xchg esi, eax
aaa
retf