joyce8/EMBER2024-capa huggingface dataset:
Function at 0x406910
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x41ecdb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, dword [esp + 0x18]
push edi
lea ecx, [esi + 4]
mov dword [esi], 0x404694
call fcn.00409484
push 4
mov dword [esp + 0x18], 0
call fcn.0040aca3
mov edi, eax
add esp, 4
test edi, edi
je 0x406984
push ebx
call fcn.0040927f
mov dword [edi], eax
call fcn.0040903e
push 0
lea ecx, [esp + 0x10]
mov ebx, eax
call fcn.00409445
mov eax, dword [ebx + 4]
cmp eax, 0xffffffff
jae 0x406978
inc eax
mov dword [ebx + 4], eax
lea ecx, [esp + 0xc]
call fcn.0040946d
pop ebx
jmp 0x406986
xor edi, edi
mov dword [esi + 0x38], edi
lea eax, [esi + 8]
mov dword [esi + 0x10], eax
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
lea edx, [esi + 0x1c]
mov dword [esi + 0x24], edx
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
lea edx, [esi + 0x2c]
mov dword [esi + 0x34], edx
mov dword [eax], 0
mov eax, dword [esi + 0x24]
mov dword [eax], 0
mov ecx, dword [esi + 0x34]
mov dword [ecx], 0
mov edx, dword [esi + 0x10]
mov dword [edx], 0
mov eax, dword [esi + 0x20]
mov dword [eax], 0
mov ecx, dword [esi + 0x30]
mov dword [ecx], 0
mov ecx, dword [esp + 0xc]
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 4

Function at 0x40b79b
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4223dc]
jne 0x40b7a5
repz ret
jmp fcn.004127fc
Function at 0x41820b
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x4223dc]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.0040e5cf
and dword [ebp - 0x14], 0
cmp dword [0x81fc70], 0
mov dword [ebp - 0x18], eax
jne 0x4182be
push 0x404010
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x418366
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x404004
push ebx
call edi
test eax, eax
je 0x418366
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push 0x403ff4
push ebx
mov dword [0x81fc70], eax
call edi
push eax
call esi
push 0x403fe0
push ebx
mov dword [0x81fc74], eax
call edi
push eax
call esi
push 0x403fc4
push ebx
mov dword [0x81fc78], eax
call edi
push eax
call esi
mov dword [0x81fc80], eax
test eax, eax
je 0x4182be
push 0x403fac
push ebx
call edi
push eax
call esi
mov dword [0x81fc7c], eax
mov eax, dword [0x81fc7c]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x418317
cmp dword [0x81fc80], ecx
je 0x418317
push eax
call esi
push dword [0x81fc80]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x418317
test ebx, ebx
je 0x418317
call edi
test eax, eax
je 0x41830e
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x41830e
test byte [ebp - 8], 1
jne 0x418317
or dword [ebp + 0x10], 0x200000
jmp 0x41834a
mov eax, dword [0x81fc74]
cmp eax, dword [ebp - 0x18]
je 0x41834a
push eax
call esi
test eax, eax
je 0x41834a
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x41834a
mov eax, dword [0x81fc78]
cmp eax, dword [ebp - 0x18]
je 0x41834a
push eax
call esi
test eax, eax
je 0x41834a
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x81fc70]
call esi
test eax, eax
je 0x418366
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x418368
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040b79b
leave
ret
Function at 0x41d490
Capabilities:
Get common file path
Manipulate console buffer

Disassembly:
mov eax, 0x22ac
call fcn.00418ad0
cmp dword [0xcca0c4], 0x37
jne 0x41d629
push 0
lea eax, [esp + 0x16ac]
push eax
push 0
push 0x404228
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetNumberFormatA]
lea ecx, [esp + 0x70]
push ecx
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_VirtualUnlock]
push 0
lea edx, [esp + 0x6ac]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_FindFirstVolumeMountPointW]
lea eax, [esp + 4]
push eax
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WriteConsoleInputA]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WaitForDebugEvent]
push 0x4042bc
push 0
call dword [sym.imp.KERNEL32.dll_CreateJobObjectW]
xor eax, eax
push eax
lea edx, [esp + 0xeac]
push edx
push 0x4042fc
mov dword [esp + 0x16], eax
mov dword [esp + 0x1a], eax
mov dword [esp + 0x1e], eax
mov word [esp + 0x22], ax
xor ecx, ecx
lea eax, [esp + 0x14]
push eax
push ecx
push ecx
mov word [esp + 0x20], cx
call dword [sym.imp.KERNEL32.dll_GetDateFormatW]
mov ecx, dword [esp + 4]
push 0
push ecx
push 0
call dword [sym.imp.ADVAPI32.dll_DuplicateToken]
push 0
lea edx, [esp + 0x2ac]
push edx
push 0x404334
call dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
push 0
lea eax, [esp + 0x1aac]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
lea ecx, [esp + 0x188]
push ecx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetCPInfoExA]
lea edx, [esp + 0x20]
push edx
push 0
lea eax, [esp + 0x64]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_PeekConsoleInputW]
lea ecx, [esp + 0x18]
push ecx
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WriteConsoleInputW]
push 0
push 0x404354
push 0
call dword [sym.imp.KERNEL32.dll__hwrite]
push 0x40421c
push 0
push 0
call dword [sym.imp.KERNEL32.dll_OpenJobObjectA]
push 0x404374
call dword [sym.imp.KERNEL32.dll_GlobalAddAtomA]
lea edx, [esp + 0x24]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetCompressedFileSizeW]
lea eax, [esp + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetProfileSectionW]
push 0x30
lea ecx, [esp + 0x30]
push 0
push ecx
mov dword [esp + 0x34], 0
call fcn.0040aac0
add esp, 0xc
lea edx, [esp + 0x28]
push edx
push 0
push 0x404380
call dword [sym.imp.KERNEL32.dll_CommConfigDialogW]
mov eax, dword [0xccc828]
mov dword [esp], eax
mov eax, 0x5d1
add dword [esp], eax
mov ecx, dword [esp]
mov dl, byte [ecx + esi]
mov eax, dword [0xcc88bc]
mov byte [eax + esi], dl
add esp, 0x22ac
ret
Function at 0x45f7e0
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
mov dword [ebp - 8], 0xffffffff
mov dword [ebp - 0xc], 0
jmp 0x45f805
mov ecx, dword [ebp - 0xc]
add ecx, 1
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0xc]
cmp edx, dword [ebp + 0xc]
jae 0x45f878
mov eax, dword [ebp - 4]
add eax, dword [ebp - 0xc]
movzx ecx, byte [eax]
movzx edx, byte [ebp - 8]
xor ecx, edx
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 8]
shr eax, 8
mov dword [ebp - 8], eax
mov dword [ebp - 0x14], 0
jmp 0x45f83a
mov ecx, dword [ebp - 0x14]
add ecx, 1
mov dword [ebp - 0x14], ecx
cmp dword [ebp - 0x14], 8
jge 0x45f86d
mov edx, dword [ebp - 0x10]
and edx, 1
neg edx
sbb edx, edx
neg edx
mov byte [ebp - 0x15], dl
mov eax, dword [ebp - 0x10]
shr eax, 1
mov dword [ebp - 0x10], eax
movzx ecx, byte [ebp - 0x15]
test ecx, ecx
je 0x45f86b
mov edx, dword [ebp - 0x10]
xor edx, 0xedb88320
mov dword [ebp - 0x10], edx
jmp 0x45f831
mov eax, dword [ebp - 8]
xor eax, dword [ebp - 0x10]
mov dword [ebp - 8], eax
jmp 0x45f7fc
mov eax, dword [ebp - 8]
not eax
mov esp, ebp
pop ebp
ret
Function at 0x4069c5
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x23c
push esi
mov esi, 0x104
lea eax, [ebp - 0x23c]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
cmp eax, esi
pop esi
jbe 0x4069e9
xor eax, eax
test eax, eax
je 0x4069fc
cmp word [ebp + eax*2 - 0x23e], 0x5c
je 0x4069fc
xor ecx, ecx
jmp 0x4069ff
xor ecx, ecx
inc ecx
push dword [ebp + 8]
lea ecx, [ecx*2 + 0x40a014]
lea eax, [ebp + eax*2 - 0x23c]
push ecx
push str._s_S.dll
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea eax, [ebp - 0x23c]
push 8
push 0
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
leave
ret 4

Function at 0x406b22
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x427dec], 0
push esi
jne 0x406b59
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x406b33
mov dword [ecx*4 + 0x427de8], eax
inc ecx
cmp ecx, 0x100
jl 0x406b2e
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x406b8a
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x427de8]
xor eax, esi
inc ecx
dec edx
jne 0x406b6c
pop edi
not eax
pop esi
ret 0xc

Function at 0x1018b5aa
Capabilities:
Resolve function by parsing pe exports

Disassembly:
xchg dword [esp], ebp
or al, 0xab
daa
movsx bp, dl
mov ebp, esp
lea eax, [esp + 0x757d7e77]
dec al
aas
sub esp, 0x18
cwde
movzx ax, bl
bsr ax, di
aad 2
push esi
movsx eax, al
aam 0x4e
push edi
daa
cmp cx, 0xec5
cmc
push ebx
cmc
dec ax
bsf eax, esp
add al, dl
push edx
add ax, 0xf604
shl al, 2
das
mov eax, dword [ebp + 8]
jmp 0x1019b226
jmp 0x1019e35b
test eax, eax
jns 0x1018bcbe
je 0x1019d41c
push edi
xor esi, 0x7efbade0
mov esi, dword [eax + 0x3c]
mov dl, 0x96
sub dl, 0x2e
test dx, ax
add esi, eax
rol dl, 2
sub dh, bl
shrd dx, cx, cl
call fcn.1019a18c
pushal
call fcn.1019d905
jmp 0x10195e48
push ebx
lea esp, [esp + 4]
je 0x1019d41c
clc
rcl esi, cl
mov esi, dword [eax + 0x3c]
bswap dx
add esi, eax
cmp ax, 0xcabd
bswap dx
mov edx, dword [esi + 0x78]
cmp bp, si
clc
stc
pushfd
test edx, edx
jmp 0x10195b84
Function at 0x4177f4
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x4203ec]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00410ce7
and dword [ebp - 0x14], 0
cmp dword [0x5dda70], 0
mov dword [ebp - 0x18], eax
jne 0x4178a7
push 0x403f30
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x41794f
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x403f24
push ebx
call edi
test eax, eax
je 0x41794f
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push 0x403f14
push ebx
mov dword [0x5dda70], eax
call edi
push eax
call esi
push 0x403f00
push ebx
mov dword [0x5dda74], eax
call edi
push eax
call esi
push 0x403ee4
push ebx
mov dword [0x5dda78], eax
call edi
push eax
call esi
mov dword [0x5dda80], eax
test eax, eax
je 0x4178a7
push 0x403ecc
push ebx
call edi
push eax
call esi
mov dword [0x5dda7c], eax
mov eax, dword [0x5dda7c]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x417900
cmp dword [0x5dda80], ecx
je 0x417900
push eax
call esi
push dword [0x5dda80]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x417900
test ebx, ebx
je 0x417900
call edi
test eax, eax
je 0x4178f7
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x4178f7
test byte [ebp - 8], 1
jne 0x417900
or dword [ebp + 0x10], 0x200000
jmp 0x417933
mov eax, dword [0x5dda74]
cmp eax, dword [ebp - 0x18]
je 0x417933
push eax
call esi
test eax, eax
je 0x417933
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x417933
mov eax, dword [0x5dda78]
cmp eax, dword [ebp - 0x18]
je 0x417933
push eax
call esi
test eax, eax
je 0x417933
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x5dda70]
call esi
test eax, eax
je 0x41794f
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x417951
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040b26b
leave
ret
Function at 0x419210
Capabilities:
Get common file path
Manipulate console buffer

Disassembly:
mov eax, 0x1388
call fcn.004180b0
cmp dword [0xa87ec4], 0x37
push esi
jne 0x419316
lea eax, [esp + 0x50]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_VirtualUnlock]
push 0
lea ecx, [esp + 0xb8c]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_FindFirstVolumeMountPointW]
mov esi, dword [sym.imp.KERNEL32.dll_WriteConsoleInputA]
lea edx, [esp + 0xc]
push edx
push 0
push 0
push 0
call esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WaitForDebugEvent]
mov eax, dword [esp + 0xc]
push 0
push eax
push 0
call dword [sym.imp.ADVAPI32.dll_DuplicateToken]
push 0
lea ecx, [esp + 0x38c]
push ecx
push 0x40401c
call dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
push 0
lea edx, [esp + 0x78c]
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea eax, [esp + 0x168]
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetCPInfoExW]
lea ecx, [esp + 0x10]
push ecx
push 0
push 0
push 0
call esi
push 0x404034
call dword [sym.imp.KERNEL32.dll_GlobalAddAtomW]
lea edx, [esp + 0x14]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetCompressedFileSizeA]
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetProfileSectionW]
push 0x30
lea ecx, [esp + 0x24]
push 0
push ecx
mov dword [esp + 0x28], 0
call fcn.0040a590
add esp, 0xc
lea edx, [esp + 0x1c]
push edx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CommConfigDialogW]
mov eax, dword [0xa8a628]
mov dword [esp + 8], eax
mov eax, 0x5d1
add dword [esp + 8], eax
mov ecx, dword [esp + 8]
mov dl, byte [ecx + edi]
mov eax, dword [0xa866bc]
mov byte [eax + edi], dl
pop esi
add esp, 0x1388
ret
Function at 0x418500
Capabilities:
Write file on windows

Disassembly:
mov eax, dword [esp + 4]
mov dword [esp + 4], eax
mov al, byte [0x4ca9f0]
test al, al
je 0x41856d
mov ecx, dword [0x4caa60]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetStdHandle]
and ecx, 0xffff
cmp ecx, 0xffffd7b2
push edi
jne 0x41853a
mov eax, dword [0x4c8cdc]
test eax, eax
je 0x41853a
push 0xfffffffffffffff5
call esi
push 0xfffffffffffffff5
call esi
mov edi, dword [sym.imp.KERNEL32.dll_WriteFile]
lea edx, [esp + 0xc]
push 0
push edx
push 0x1d
push 0x4c99c0
push eax
call edi
push 0xfffffffffffffff5
call esi
lea ecx, [esp + 0xc]
push 0
push ecx
push 2
push 0x4caa70
push eax
call edi
pop edi
pop esi
ret
mov al, byte [0x4c9548]
test al, al
jne 0x418587
push 0
push 0
push 0x4c99c0
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
ret

Function at 0x455f40
Capabilities:
Encode data using xor

Disassembly:
sahf
out 0x85, al
pop ebx
movsb byte es:[edi], byte [esi]
wait
mov bh, 0x8c
cmc
push 0x16
adc al, 0xa1
imul edi, dword [eax - 0x58555f92], 0xfffffffa
imul esp, dword [ecx], 0xffffff9f
lds esi, [edi + 0x2a]
iretd
loop 0x455ee6
mov cl, bh
popal
mov esp, 0xe2defa10
jae 0x455f60
dec ebp
xchg byte [ebx + 0x69], ah
and esi, ebx
loop 0x455f5a
inc edi
invalid
jle 0x455fc8
call ecx
sbb dword [ebx - 0x6d17fd82], eax
jle 0x455f64
call 0x540e06f9
idiv dword [ebp + 5]
mul esi
sub ebx, dword [edi]
cmpsd dword [esi], dword es:[edi]
enter 0xfffffffffffff753, 0x7d
add eax, 0x1f2be6f7
jno 0x455f3b
stosb byte es:[edi], al
pop ebp
invalid
idiv dword [eax + ebx*4]
retf

Function at 0x4862c0
Capabilities:
Encode data using xor

Disassembly:
xchg esp, eax
mov esi, 0x3595f53a
int1
dec ebx
mov al, 0x16
invalid
lcall 0xa0e6, 0xa40c561d
inc esi
push cs
out 0xd6, eax
push es
pop ds
jno 0x4862af
cmpsb byte [esi], byte es:[edi]
sbb eax, 0xde65d346
ja 0x486307
adc al, 0x66
mov dl, 0x3b
cmp dl, byte [ebx + 0x7428b6bd]
sal byte [ebx - 0x3848c66e], 1
and cl, ah
invalid
and edi, dword [ebx - 0x1b8518a9]
ja 0x48630d
xchg ebp, eax
jecxz 0x48638a
aaa
adc edi, edi
div ebx
mov ah, 0xdf
sar byte [ebx], 1
sub dword [esi], edi
ja 0x48632b
inc ecx
mov al, byte [0xb717757b]
les edi, [0x2d35273e]
mov edx, 0x19ad6fdd
rcr dword fs:[ebx + ebx + 0x52], 0xb9
test byte [ebp - 0x57], bh
arpl ax, si
mov byte [eax + 0x63], bh
in al, dx
cwde
mov esi, 0x5fac9486
mov bl, byte [esi + 0x4b]
and al, 0x53
mov esp, 0x870199d2
out dx, al
mov edi, 0xbda4987a
xor byte [edi], bh
push edi
xor ch, byte [0xcb844fea]
stc
lodsd eax, dword [esi]
and eax, 0xffffffc0
test eax, 0xa7fc2ca2
xchg esi, eax
out 0x60, eax
retf
rol dword [ebp + 0x50f1c3d0], 0x71
dec ebx
mov byte [ecx], bh
mov word [eax], cs
invalid
Function at 0x49f360
Capabilities:
Encode data using xor

Disassembly:
dec edi
push 0x4c
in al, dx
ret
movsb byte es:[edi], byte [esi]
xchg esp, eax
out dx, al
aad 9
je 0x49f364
jnp 0x49f2c6
retf
sar byte [esi], 0x86
mov dh, 0xcc
add dh, byte [ebx]
jle 0x49f33e
xor edi, dword [esi - 3]
aad 0x76
cmp dword es:[ebx + 0x5b], edx
jmp 0xd38344af
arpl word [ecx + 0x39], dx
sal dword [esp + edx*8 + 0x67], cl
or eax, 0xdb0d9446
mov al, byte [ecx - 0x78]
stosd dword es:[edi], eax
stosb byte es:[edi], al
jns 0x49f338
invalid
in al, dx
aam 0xb2
mov dl, 0x93
mov dl, 0x93
cmp eax, 0x7a2111e1
loopne 0x49f2ec
adc dword [ecx], esp
jp 0x49f348
sbb dword [edx + 0x50af824f], 0x30
mov eax, dword [0x7c8230e5]
pop ebp
jl 0x49f3b7
lcall 0xa130, 0x50af824f
in eax, 0x30
cmp byte [edi + ecx*4 - 0x3b], 0x7c
aas
pop esi
insb byte es:[edi], dx
and dword [ebx + 0x57], eax
aad 0xc8
sal byte [edx + 0x22], cl
mov edi, ebp
les esi, [ebx - 0x2e]
jno 0x49f35e
test dword [ebx - 0xc], edx
pop ebx
dec eax
inc esi
test dword [eax - 0x41], ebp
xor al, 0x6d
invalid
xor dword [ebp + 0x4e], edi
mov byte [0xd8ef7053], al
hlt

Function at 0x4be26a
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x4c6390
cmp edx, dword [eax]
je 0x4be28c
add eax, 8
inc ecx
cmp eax, 0x4c6420
jl 0x4be27d
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x4c6390]
jne 0x4be3ba
mov eax, dword [0x4caa7c]
cmp eax, 1
je 0x4be394
test eax, eax
jne 0x4be2bd
cmp dword [0x4c62d4], 1
je 0x4be394
cmp edx, 0xfc
je 0x4be3ba
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4be2f4
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.004be980
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.004bebb0
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x4be337
lea eax, [ebp - 0x1a4]
push eax
call fcn.004bebb0
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x4c29c8
push edi
call fcn.004c0380
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.004be980
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.004be990
lea eax, [ebp - 0xa0]
push 0x4c29a8
push eax
call fcn.004be990
push dword [esi + 0x4c6394]
lea eax, [ebp - 0xa0]
push eax
call fcn.004be990
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.004c02f4
add esp, 0x2c
pop edi
jmp 0x4be3ba
lea eax, [ebp + 8]
lea esi, [esi + 0x4c6394]
push 0
push eax
push dword [esi]
call fcn.004bebb0
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x5e7900
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x193000]
push edi
jmp 0x5e791a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x5e7921
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x5e7910
mov eax, 1
add ebx, ebx
jne 0x5e7933
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x5e7944
jne 0x5e7963
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x5e7963
dec eax
add ebx, ebx
jne 0x5e7950
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x5e7928
add ebx, ebx
jne 0x5e795f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x5e79b5
xor ecx, ecx
sub eax, 3
jb 0x5e797b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x5e79ea
sar eax, 1
mov ebp, eax
jmp 0x5e7986
add ebx, ebx
jne 0x5e7986
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x5e7954
inc ecx
add ebx, ebx
jne 0x5e7994
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x5e7954
add ebx, ebx
jne 0x5e79a1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x5e7996
jne 0x5e79b2
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x5e7996
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x5e79d4
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x5e79c6
jmp 0x5e7916
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x5e79d4
add edi, ecx
jmp 0x5e7916
pop esi
mov edi, esi
mov ecx, 0x3ed9
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x5e79f2
cmp byte [edi], 0x11
jne 0x5e79f2
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x5e79f7
lea edi, [esi + 0x1e0000]
mov eax, dword [edi]
or eax, eax
je 0x5e7a6f
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x2f8cd4]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x2f8e50]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x5e7a24
mov ecx, edi
jns 0x5e7a53
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x2f8e54]
or eax, eax
je 0x5e7a69
mov dword [ebx], eax
add ebx, 4
jmp 0x5e7a41
call dword [esi + 0x2f8e64]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x5e7aa0
cmp al, 0xef
ja 0x5e7a93
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x5e7a75
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x5e7a82
mov ebp, dword [esi + 0x2f8e58]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x227]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x5e7ad4
sub esp, 0xffffff80
jmp 0x425f74
Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x42e00c
nop
nop
nop
nop
pop eax
nop
nop
add eax, 0x403ac5
sub eax, 0x403a6b
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
xor dword [ebx], edx
add ebx, 4
nop
nop
nop
nop
nop
nop
nop
cmp ebx, ecx
jl 0x42e030
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x42e01e
nop
nop
nop
nop
nop
nop
nop
popal
jmp fcn.00401219