joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4304d1
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
cmp dword [0x4a062c], 0
push esi
jne 0x430444
call fcn.0043036a
test eax, eax
je 0x430487
mov eax, dword [0x4a062c]
cmp eax, 1
jne 0x430465
push 0xd
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
je 0x430487
pop esi
ret
push eax
call dword [0x4a0634]
test eax, eax
jne 0x4304cf
push 0x40
mov eax, 0x1000
push eax
push eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov esi, eax
test esi, esi
jne 0x43048b
xor eax, eax
pop esi
ret
mov eax, dword [esi]
push edi
push dword [0x4a062c]
call dword [0x4a0634]
mov edi, eax
test edi, edi
je 0x4304b0
push 0x8000
push 0
push esi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x4304cc
mov edi, esi
add esi, 0xff0
push edi
push dword [0x4a062c]
call dword [0x4a0630]
add edi, 0x10
cmp edi, esi
jb 0x4304b8
mov eax, edi
pop edi
pop esi
ret
jmp 0x430431

Function at 0x432590
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x45b1f6
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4773f0]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x18], esi
xor eax, eax
mov dword [esi + 4], eax
mov dword [esi], vtable.CNnWindowBase.0
lea ebx, [esi + 8]
mov dword [ebx], eax
mov dword [ebx + 4], eax
mov dword [ebx + 8], eax
mov dword [ebx + 0xc], eax
lea ebp, [esi + 0x20]
lea edi, [esi + 0x40]
mov ecx, edi
mov dword [ebp], eax
mov dword [ebp + 4], eax
mov dword [ebp + 8], eax
mov dword [ebp + 0xc], eax
call fcn.00432110
lea eax, [esp + 0x17]
push eax
lea edx, [esp + 0x1b]
lea ecx, [esi + 0x58]
push edx
mov dword [esp + 0x30], 0
call fcn.00431e50
lea ecx, [esi + 0x78]
mov byte [esp + 0x28], 1
call fcn.00432110
push ebx
call dword [sym.imp.USER32.dll_SetRectEmpty]
xor ebx, ebx
push ebp
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], 0xffffffff
call dword [sym.imp.USER32.dll_SetRectEmpty]
mov dword [esi + 0x3c], ebx
mov dword [esi + 0x34], ebx
mov dword [esi + 0x30], 0xff
mov dword [esi + 0x38], ebx
mov ebx, dword [edi + 0x10]
cmp dword [edi + 0xc], ebx
jbe 0x43264d
call fcn.0044476d
mov ebp, dword [edi + 0xc]
mov eax, dword [edi]
mov dword [esp + 0x18], eax
cmp ebp, dword [edi + 0x10]
jbe 0x432660
call fcn.0044476d
mov ecx, dword [esp + 0x18]
mov eax, dword [edi]
push ebx
push ecx
push ebp
push eax
lea edx, [esp + 0x28]
push edx
mov ecx, edi
call fcn.00431100
mov eax, esi
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret
Function at 0x432980
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x64
push esi
mov esi, dword [ecx + 8]
test esi, esi
jne 0x432994
xor eax, eax
pop esi
add esp, 0x64
ret 4
push 0x54
lea eax, [esp + 0x18]
push 0
push eax
call fcn.00446040
add esp, 0xc
lea ecx, [esp + 0x14]
push ecx
push 0x54
push esi
call dword [sym.imp.GDI32.dll_GetObjectW]
test eax, eax
je 0x43298b
push edi
mov edi, dword [esp + 0x2c]
test edi, edi
je 0x432ab1
mov ecx, dword [esp + 0x38]
test ecx, ecx
je 0x432ab1
mov eax, dword [esp + 0x34]
test eax, eax
je 0x432ab1
mov dword [esp + 0xc], 0
test ecx, ecx
jle 0x432aa4
push ebx
push ebp
mov edi, edi
xor ebp, ebp
test eax, eax
jle 0x432a91
mov eax, dword [esp + 0x78]
mov bx, ax
movzx edx, al
shr bx, 8
shr eax, 0x10
mov dword [esp + 0x18], edx
mov dword [esp + 0x1c], eax
mov eax, dword [edi]
mov dword [esp + 0x10], eax
shr eax, 0x18
imul eax, dword [esp + 0x18]
movzx esi, byte [esp + 0x13]
mov ecx, eax
mov eax, 0x80808081
imul ecx
add edx, ecx
sar edx, 7
mov eax, edx
shr eax, 0x1f
add eax, edx
movzx ecx, bl
imul ecx, esi
mov byte [esp + 0x12], al
mov eax, 0x80808081
imul ecx
add edx, ecx
sar edx, 7
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov byte [esp + 0x11], cl
movzx ecx, byte [esp + 0x1c]
imul ecx, esi
mov eax, 0x80808081
imul ecx
add edx, ecx
sar edx, 7
mov eax, edx
shr eax, 0x1f
add eax, edx
mov byte [esp + 0x10], al
mov ecx, dword [esp + 0x10]
mov dword [edi], ecx
mov eax, dword [esp + 0x3c]
inc ebp
add edi, 4
cmp ebp, eax
jl 0x432a13
mov ecx, dword [esp + 0x40]
mov edx, dword [esp + 0x14]
inc edx
cmp edx, ecx
mov dword [esp + 0x14], edx
jl 0x4329f0
pop ebp
pop ebx
pop edi
mov eax, 1
pop esi
add esp, 0x64
ret 4
pop edi
xor eax, eax
pop esi
add esp, 0x64
ret 4

Function at 0x4330e0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0xffffffffffffffff
push 0x45b228
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4773f0]
xor eax, esp
push eax
lea eax, [esp + 0x24]
mov dword fs:[0], eax
mov dword [esp + 0x14], ecx
mov edi, dword [esp + 0x34]
xor ebp, ebp
mov dword [esp + 0x18], ebp
mov dword [esp + 0x20], edi
mov eax, dword [esp + 0x3c]
mov ecx, dword [esp + 0x38]
push eax
push ecx
push edi
mov dword [esp + 0x38], ebp
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov ebx, eax
mov dword [esp + 0x1c], ebx
cmp ebx, ebp
je 0x433195
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
mov dword [esp + 0x18], esi
cmp esi, ebp
je 0x43318a
push esi
call dword [sym.imp.KERNEL32.dll_LockResource]
push ebx
push edi
mov ebp, eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push 1
push eax
push ebp
call fcn.004344d0
add esp, 0xc
test eax, eax
je 0x43318a
mov ecx, dword [esp + 0x14]
push eax
mov dword [ecx + 4], 1
call fcn.004326f0
push esi
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, 1
jmp 0x433197
test esi, esi
je 0x433195
push esi
call dword [sym.imp.KERNEL32.dll_FreeResource]
xor eax, eax
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret 0xc
Function at 0x4331b0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x45b258
mov eax, dword fs:[0]
push eax
sub esp, 0x10
mov eax, dword [0x4773f0]
xor eax, esp
mov dword [esp + 0xc], eax
push ebx
push esi
push edi
mov eax, dword [0x4773f0]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov edi, dword [esp + 0x30]
push edi
mov esi, ecx
call fcn.004345a0
add esp, 4
test eax, eax
je 0x4332c0
mov eax, dword [0x4788a4]
xor ebx, ebx
mov dword [esp + 0x18], ebx
mov dword [esp + 0x10], eax
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x20]
push eax
push edi
mov dword [esp + 0x38], ebx
mov dword [esp + 0x24], ebx
call fcn.004345e0
add esp, 0x10
test eax, eax
jne 0x433267
mov eax, dword [esp + 0x10]
lea ecx, [eax - 0xc]
mov dword [esp + 0x28], 0xffffffff
cmp ecx, dword [0x4788a0]
je 0x433260
add eax, 0xfffffff4
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jg 0x433260
mov edx, dword [esp + 0x10]
add edx, 0xfffffff4
push edx
call fcn.00443685
add esp, 4
xor eax, eax
jmp 0x4332eb
mov ecx, esi
call fcn.004326d0
movzx ecx, word [esp + 0x14]
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x18]
push eax
push ecx
push edx
mov ecx, esi
call fcn.004330e0
mov esi, eax
mov eax, dword [esp + 0x10]
lea ecx, [eax - 0xc]
mov dword [esp + 0x28], 0xffffffff
cmp ecx, dword [0x4788a0]
je 0x4332bc
add eax, 0xfffffff4
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jg 0x4332bc
mov edx, dword [esp + 0x10]
add edx, 0xfffffff4
push edx
call fcn.00443685
add esp, 4
mov eax, esi
jmp 0x4332eb
mov ecx, esi
call fcn.004326d0
push 1
push edi
xor ebx, ebx
call fcn.004343c0
add esp, 8
cmp eax, ebx
je 0x4332e9
push eax
mov ecx, esi
call fcn.004326f0
mov ebx, eax
mov dword [esi + 4], 1
mov eax, ebx
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xc]
xor ecx, esp
call fcn.0044331b
add esp, 0x1c
ret 8
Function at 0x4343c0
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x14
mov eax, dword [0x4773f0]
xor eax, esp
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x18]
push esi
push edi
push 0x45e844
push eax
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
xor edi, edi
call fcn.004471dd
mov esi, eax
add esp, 8
test esi, esi
je 0x434483
push esi
push 8
lea eax, [esp + 0x18]
push 1
push eax
call fcn.00447007
push 8
lea ecx, [esp + 0x24]
push edi
push ecx
call fcn.0043ad10
add esp, 0x1c
test eax, eax
jne 0x434483
push eax
push method.CNnControlBase.virtual_8
push eax
push str.1.4.0
call fcn.00435c10
add esp, 0x10
mov dword [esp + 8], eax
test eax, eax
je 0x4344ae
push eax
call fcn.0043b830
add esp, 4
mov dword [esp + 0xc], eax
test eax, eax
je 0x434483
mov edx, dword [esp + 8]
push 0x434350
push esi
push edx
call fcn.0043b8d0
mov eax, dword [esp + 0x14]
push 8
push eax
call fcn.0043acd0
mov ecx, dword [esp + 0x38]
mov edx, dword [esp + 0x20]
mov eax, dword [esp + 0x1c]
push ecx
push edx
push eax
call fcn.00434070
add esp, 0x20
mov edi, eax
cmp dword [esp + 8], 0
je 0x4344ae
cmp dword [esp + 0xc], 0
push 0
je 0x43449f
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x10]
push edx
jmp 0x4344a6
push 0
lea eax, [esp + 0x10]
push eax
call fcn.00435c40
add esp, 0xc
test esi, esi
je 0x4344bb
push esi
call fcn.0044709b
add esp, 4
mov ecx, dword [esp + 0x18]
mov eax, edi
pop edi
pop esi
xor ecx, esp
call fcn.0044331b
add esp, 0x14
ret
Function at 0x436660
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
mov edx, dword [esp + 4]
sub esp, 0x10
push ebx
mov bl, byte [edx + 8]
cmp bl, 3
je 0x43680a
mov ecx, dword [esp + 0x20]
push ebp
mov ebp, dword [edx]
push esi
xor esi, esi
push edi
mov dword [esp + 0x24], esi
test bl, 2
je 0x4366b8
movzx eax, byte [edx + 9]
movzx esi, byte [ecx]
mov edi, eax
sub edi, esi
movzx esi, byte [ecx + 1]
mov dword [esp + 0x10], edi
mov edi, eax
sub edi, esi
movzx esi, byte [ecx + 2]
sub eax, esi
mov esi, dword [esp + 0x24]
mov dword [esp + 0x14], edi
mov dword [esp + 0x18], eax
mov edi, 3
jmp 0x4366cb
movzx eax, byte [ecx + 3]
movzx edi, byte [edx + 9]
sub edi, eax
mov dword [esp + 0x10], edi
mov edi, 1
test bl, 4
je 0x4366df
movzx ecx, byte [ecx + 4]
movzx eax, byte [edx + 9]
sub eax, ecx
mov dword [esp + edi*4 + 0x10], eax
inc edi
xor ecx, ecx
xor eax, eax
cmp edi, ecx
jle case.0x436726.3
jmp 0x4366f0
cmp dword [esp + eax*4 + 0x10], ecx
jg 0x4366fc
mov dword [esp + eax*4 + 0x10], ecx
jmp 0x436701
mov esi, 1
inc eax
cmp eax, edi
jl 0x4366f0
cmp si, cx
je case.0x436726.3
movzx eax, byte [edx + 9]
add eax, 0xfffffffe
cmp eax, 0xe
ja case.0x436726.3
movzx eax, byte [eax + 0x436824]
jmp dword [eax*4 + 0x436810]
mov edx, dword [edx + 4]
mov eax, dword [esp + 0x28]
cmp edx, ecx
jbe case.0x436726.3
lea esp, [esp]
mov cl, byte [eax]
shr cl, 1
and cl, 0x55
mov byte [eax], cl
inc eax
sub edx, 1
jne 0x436740
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
mov edi, dword [edx + 4]
mov edx, dword [esp + 0x10]
mov esi, dword [esp + 0x28]
mov ecx, edx
mov eax, 0xf0
sar eax, cl
mov ebx, 0xf
sar ebx, cl
and al, 0xf0
or al, bl
test edi, edi
jbe case.0x436726.3
mov edi, edi
mov bl, byte [esi]
mov cl, dl
shr bl, cl
inc esi
and bl, al
sub edi, 1
mov byte [esi - 1], bl
jne 0x436780
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
mov esi, dword [esp + 0x28]
imul ebp, edi
xor ebx, ebx
test ebp, ebp
jbe case.0x436726.3
mov eax, ebx
xor edx, edx
div edi
inc ebx
inc esi
mov cl, byte [esp + edx*4 + 0x10]
shr byte [esi - 1], cl
cmp ebx, ebp
jb 0x4367a6
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
mov esi, dword [esp + 0x28]
imul ebp, edi
xor ebx, ebx
test ebp, ebp
jbe case.0x436726.3
mov edi, edi
xor edx, edx
mov eax, ebx
div edi
movzx ax, byte [esi]
mov ecx, 0x100
imul ax, cx
movzx ecx, byte [esi + 1]
add ax, cx
inc esi
inc ebx
inc esi
movzx ecx, word [esp + edx*4 + 0x10]
shr ax, cl
movzx eax, ax
mov edx, eax
shr edx, 8
mov byte [esi - 2], dl
mov byte [esi - 1], al
cmp ebx, ebp
jb 0x4367d0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
Function at 0x44331b
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4773f0]
jne 0x443325
repz ret
jmp fcn.004480d8

Function at 0x44db1f
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00449d86
and dword [ebp - 4], 0
cmp dword [0x4a0ec0], 0
mov ebx, eax
jne 0x44dbd0
push 0x463c78
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov edi, eax
test edi, edi
je 0x44dc81
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x463c6c
push edi
call esi
test eax, eax
je 0x44dc81
push eax
call fcn.00449d14
mov dword [esp], 0x463c5c
push edi
mov dword [0x4a0ec0], eax
call esi
push eax
call fcn.00449d14
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x4a0ec4], eax
call esi
push eax
call fcn.00449d14
mov dword [esp], str.GetUserObjectInformationW
push edi
mov dword [0x4a0ec8], eax
call esi
push eax
call fcn.00449d14
pop ecx
mov dword [0x4a0ed0], eax
test eax, eax
je 0x44dbd0
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00449d14
pop ecx
mov dword [0x4a0ecc], eax
mov eax, dword [0x4a0ecc]
cmp eax, ebx
je 0x44dc28
cmp dword [0x4a0ed0], ebx
je 0x44dc28
push eax
call fcn.00449d8f
push dword [0x4a0ed0]
mov esi, eax
call fcn.00449d8f
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x44dc28
test edi, edi
je 0x44dc28
call esi
test eax, eax
je 0x44dc1f
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x44dc1f
test byte [ebp - 0xc], 1
jne 0x44dc28
or dword [ebp + 0x10], 0x200000
jmp 0x44dc61
mov eax, dword [0x4a0ec4]
cmp eax, ebx
je 0x44dc61
push eax
call fcn.00449d8f
pop ecx
test eax, eax
je 0x44dc61
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x44dc61
mov eax, dword [0x4a0ec8]
cmp eax, ebx
je 0x44dc61
push eax
call fcn.00449d8f
pop ecx
test eax, eax
je 0x44dc61
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x4a0ec0]
call fcn.00449d8f
pop ecx
test eax, eax
je 0x44dc81
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x44dc83
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4541cb
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00449d86
and dword [ebp - 4], 0
cmp dword [0x4a1128], 0
mov ebx, eax
jne 0x45427c
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x45432d
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x45432d
push eax
call fcn.00449d14
mov dword [esp], 0x463c5c
push edi
mov dword [0x4a1128], eax
call esi
push eax
call fcn.00449d14
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x4a112c], eax
call esi
push eax
call fcn.00449d14
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x4a1130], eax
call esi
push eax
call fcn.00449d14
pop ecx
mov dword [0x4a1138], eax
test eax, eax
je 0x45427c
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00449d14
pop ecx
mov dword [0x4a1134], eax
mov eax, dword [0x4a1134]
cmp eax, ebx
je 0x4542d4
cmp dword [0x4a1138], ebx
je 0x4542d4
push eax
call fcn.00449d8f
push dword [0x4a1138]
mov esi, eax
call fcn.00449d8f
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x4542d4
test edi, edi
je 0x4542d4
call esi
test eax, eax
je 0x4542cb
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x4542cb
test byte [ebp - 0xc], 1
jne 0x4542d4
or dword [ebp + 0x10], 0x200000
jmp 0x45430d
mov eax, dword [0x4a112c]
cmp eax, ebx
je 0x45430d
push eax
call fcn.00449d8f
pop ecx
test eax, eax
je 0x45430d
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x45430d
mov eax, dword [0x4a1130]
cmp eax, ebx
je 0x45430d
push eax
call fcn.00449d8f
pop ecx
test eax, eax
je 0x45430d
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x4a1128]
call fcn.00449d8f
pop ecx
test eax, eax
je 0x45432d
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x45432f
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x457220
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x48000]
push edi
jmp 0x45723a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x457241
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x457230
mov eax, 1
add ebx, ebx
jne 0x457253
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x457264
jne 0x457283
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x457283
dec eax
add ebx, ebx
jne 0x457270
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x457248
add ebx, ebx
jne 0x45727f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x4572d5
xor ecx, ecx
sub eax, 3
jb 0x45729b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x45730a
sar eax, 1
mov ebp, eax
jmp 0x4572a6
add ebx, ebx
jne 0x4572a6
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x457274
inc ecx
add ebx, ebx
jne 0x4572b4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x457274
add ebx, ebx
jne 0x4572c1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x4572b6
jne 0x4572d2
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4572b6
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x4572f4
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x4572e6
jmp 0x457236
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x4572f4
add edi, ecx
jmp 0x457236
pop esi
mov edi, esi
mov ecx, 0x1a6d
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x457312
cmp byte [edi], 4
jne 0x457312
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x457317
lea edi, [esi + 0x54000]
mov eax, dword [edi]
or eax, eax
je 0x45738f
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x57000]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x57118]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x457344
mov ecx, edi
jns 0x457373
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x5711c]
or eax, eax
je 0x457389
mov dword [ebx], eax
add ebx, 4
jmp 0x457361
call dword [esi + 0x5712c]
mov ebp, dword [esi + 0x57120]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x207]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x4573c3
sub esp, 0xffffff80
jmp section.UPX0
Function at 0x1000d760
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
lea eax, [fcn.1000d760]
mov ecx, dword [0x10303de0]
sub ecx, 0x13ec
mov dword [0x10303de0], ecx
mov dword [ebp - 8], eax
jmp 0x1000d78c
mov dword [ebp - 4], 0
jmp 0x1000d7ea
mov eax, dword [ebp - 8]
movzx eax, word [eax]
cmp eax, 0x5a4d
jne 0x1000d7ba
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x3c]
add eax, dword [ebp - 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
cmp dword [eax], 0x4550
jne 0x1000d7b8
mov eax, dword [ebp - 8]
mov dword [ebp - 4], eax
jmp 0x1000d7ea
jmp 0x1000d7ba
mov eax, dword [ebp - 8]
sub eax, 0x1000
and eax, 0xfffff000
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 8], eax
mov ecx, dword [0x10303de0]
sub ecx, 0xd3b
mov dword [0x10303de0], ecx
mov al, 1
test al, 1
jne 0x1000d78c
jmp 0x1000d783
mov eax, dword [ebp - 4]
add esp, 0x10
pop ebp
ret
Function at 0x1000e380
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x1c
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x24], esi
mov eax, dword [0x10303de0]
sub eax, 0xd5f
mov dword [0x10303de0], eax
mov dword [0x10303de8], 0
mov dword [0x10303dec], 0
mov dword [0x10303df4], 0
mov dword [ebp - 0x20], 0
mov dword [0x10303de4], 0x24fe
mov dword [ebp - 0x10], 0
mov eax, dword [0x10303de4]
add eax, 0x267
mov dword [0x10303de0], eax
mov dword [0x10303de4], 0x667
mov dword [ebp - 0x10], 0
jmp 0x1000e41b
add esp, 0x1c
pop esi
pop edi
pop ebx
pop ebp
ret
mov eax, dword [ebp - 0x10]
add eax, 1
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x10], eax
jae 0x1000e408
mov eax, 0x100
mov ecx, dword [0x10303de8]
add ecx, 1
mov dword [ebp - 0x28], eax
mov eax, ecx
cdq
mov ecx, dword [ebp - 0x28]
idiv ecx
mov dword [0x10303de8], edx
mov dword [0x10303de0], 0x210
mov edx, dword [0x10303dec]
mov esi, dword [0x10303de8]
mov edi, dword [ebp - 0x24]
movzx esi, byte [edi + esi]
add edx, esi
mov eax, edx
cdq
idiv ecx
mov dword [0x10303dec], edx
mov edx, dword [0x10303de8]
mov esi, dword [ebp - 0x24]
mov bl, byte [esi + edx]
mov byte [0x10303df0], bl
mov dword [0x10303de4], 0x26fb
mov edx, dword [0x10303dec]
mov esi, dword [ebp - 0x24]
mov bl, byte [esi + edx]
mov edx, dword [0x10303de8]
mov esi, dword [ebp - 0x24]
mov byte [esi + edx], bl
mov bl, byte [0x10303df0]
mov edx, dword [0x10303dec]
mov esi, dword [ebp - 0x24]
mov byte [esi + edx], bl
mov dword [0x10303de0], 0x168
mov edx, dword [0x10303de8]
mov esi, dword [ebp - 0x24]
movzx edx, byte [esi + edx]
mov esi, dword [0x10303dec]
mov edi, dword [ebp - 0x24]
movzx esi, byte [edi + esi]
add edx, esi
mov dword [ebp - 0x20], edx
mov edx, dword [ebp - 0x20]
mov eax, edx
cdq
idiv ecx
mov dword [0x10303df4], edx
mov edx, dword [0x10303de0]
sub edx, 0x2567
mov dword [0x10303de0], edx
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x18]
movzx eax, byte [ecx + eax]
mov ecx, dword [0x10303df4]
mov edx, dword [ebp - 0x24]
movzx ecx, byte [edx + ecx]
xor eax, ecx
mov bl, al
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x1c]
mov byte [ecx + eax], bl
jmp 0x1000e410
Function at 0x1000e630
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [ebp - 8], 0
mov dword [0x10303de0], 0x185b
mov eax, dword fs:[0x30]
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
mov eax, dword [0x10303de0]
sub eax, 0x1598
mov dword [0x10303de0], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x10]
add eax, 0x38
add eax, 4
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov dword [ebp - 0xc], ecx
mov dword [ebp - 0x10], 0
jmp 0x1000e6ed
mov dword [0x10303de4], 0x13a9
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
movzx eax, word [eax + ecx*2 - 0x18]
cmp eax, 0x6f
je 0x1000e744
jmp 0x1000e7c2
mov eax, dword [ebp - 4]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
add esp, 0x28
pop ebp
ret
mov dword [0x10303de0], 0xbc0
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x1c]
movzx eax, word [ecx + eax*2 - 0x12]
cmp eax, 0x64
je 0x1000e76e
jmp 0x1000e7bc
mov dword [ebp - 4], 0
jmp 0x1000e6ab
cmp dword [ebp - 0x10], 0x104
jge 0x1000e726
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x20]
movzx eax, word [ecx + eax*2]
cmp eax, 0
jne 0x1000e70f
jmp 0x1000e726
mov dword [0x10303de0], 0xed6
mov eax, dword [ebp - 0x10]
add eax, 1
mov dword [ebp - 0x10], eax
jmp 0x1000e6ed
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x24]
movzx eax, word [ecx + eax*2 - 0x1a]
cmp eax, 0x6c
je 0x1000e686
jmp 0x1000e6e4
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
movzx eax, word [eax + ecx*2 - 0x16]
cmp eax, 0x61
jne 0x1000e7c0
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
movzx eax, word [eax + ecx*2 - 0x14]
cmp eax, 0x64
je 0x1000e6b9
jmp 0x1000e7be
mov dword [0x10303de4], 0xd0a
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
movzx eax, word [eax + ecx*2 - 0x10]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
cmp eax, 0x6c
jne 0x1000e7ba
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
movzx eax, word [eax + ecx*2 - 0xe]
cmp eax, 0x6c
jne 0x1000e7b8
mov dword [0x10303de4], 0x151b
mov dword [ebp - 4], 1
jmp 0x1000e6ab
jmp 0x1000e7ba
jmp 0x1000e7bc
jmp 0x1000e7be
jmp 0x1000e7c0
jmp 0x1000e7c2
jmp 0x1000e6e4