joyce8/EMBER2024-capa huggingface dataset:
Function at 0x429240
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], edi
mov dword [ebp - 4], esi
mov edi, dword [ebp + 8]
mov esi, dword [edi + 0x7c]
test esi, esi
je 0x429322
mov eax, dword [0x4ee720]
mov ebx, dword [esi + 0x14]
lea edx, [ebx*4]
shl ebx, 5
sub ebx, edx
cmp eax, 2
lea edx, [ebx + 0x4f6588]
jge 0x429293
mov edx, dword [edx]
test edx, edx
jne 0x4292dd
mov eax, dword [0x4ee720]
mov dword [ebx + 0x4f6588], 1
jmp 0x4292dd
push edx
mov dword [ebp - 0x10], edx
call fcn.00410ec0
mov edx, dword [ebp - 0x10]
add esp, 4
test eax, eax
jne 0x4292d8
cmp dword [ebx + 0x4f6584], 0
je 0x4293e6
mov dword [ebx + 0x4f6588], 0
push 0xffffffffffffffff
push dword [ebx + 0x4f6584]
mov dword [ebp - 0x10], edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edx, dword [ebp - 0x10]
push edx
call fcn.00410ec0
pop ecx
mov eax, dword [0x4ee720]
cmp eax, 1
je 0x4293d4
mov eax, dword [esi + 0x18]
dec eax
mov dword [esi + 0x18], eax
test eax, eax
jle 0x42934c
mov eax, dword [0x4ee720]
cmp eax, 1
je 0x429331
cmp eax, 2
jge 0x42930c
mov dword [ebx + 0x4f6588], 0
jmp 0x429322
push dword [ebx + 0x4f6584]
mov dword [ebx + 0x4f6588], 0
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov ebx, dword [ebp - 0xc]
mov esi, dword [ebp - 4]
mov edi, dword [ebp - 8]
xor eax, eax
mov esp, ebp
pop ebp
ret
push dword [ebx + 0x4f6598]
push dword [ebx + 0x4f6594]
call fcn.00410ea0
add esp, 8
mov eax, dword [0x4ee720]
jmp 0x4292fb
mov edx, dword [esi]
test edx, edx
je 0x42935a
mov eax, dword [esi + 4]
mov dword [edx + 4], eax
mov edx, dword [esi]
mov eax, dword [esi + 4]
test eax, eax
je 0x429365
mov dword [eax], edx
jmp 0x42936b
mov dword [ebx + 0x4f6580], edx
mov eax, dword [0x4ee720]
mov dword [edi + 0x7c], 0
cmp eax, 1
je 0x4293b9
cmp eax, 2
jge 0x42938d
mov dword [ebx + 0x4f6588], 0
jmp 0x4293a3
push dword [ebx + 0x4f6584]
mov dword [ebx + 0x4f6588], 0
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push dword [esi + 8]
call fcn.004193c0
push esi
call fcn.004193c0
add esp, 8
jmp 0x429322
push dword [ebx + 0x4f6598]
push dword [ebx + 0x4f6594]
call fcn.00410ea0
add esp, 8
mov eax, dword [0x4ee720]
jmp 0x42937c
lea eax, [ebx + 0x4f6594]
push eax
call fcn.00410e70
pop ecx
jmp 0x4292e6
mov dword [ebp - 0x10], edx
xor eax, eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov edx, dword [ebp - 0x10]
mov dword [ebx + 0x4f6588], 0
mov dword [ebx + 0x4f6584], eax
jmp 0x4292bd
Function at 0x42f820
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
mov edx, dword [esp + 8]
mov ecx, dword [esp + 0xc]

Function at 0x42f82c
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], edi
mov dword [ebp - 4], esi
mov ebx, ecx
mov esi, edx
mov ecx, eax
mov edx, dword [ebp + 0x14]
mov dword [edx], 0
cmp dword [0x4fb140], 0
je 0x42f903
cmp dword [ebp + 0x20], 2
je 0x42f863
cmp dword [ebp + 0x20], 1
jne 0x42f872
mov ebx, dword [ebp - 8]
mov esi, dword [ebp - 4]
mov eax, 0xffffffff
mov esp, ebp
pop ebp
ret
cmp dword [ebp + 0x18], 0
je 0x42f882
cmp dword [ebp + 0x20], 0xfffffffa
je 0x42f98c
cmp dword [ebp + 0x20], 0
je 0x42f998
xor edx, edx
xor edi, edi
cmp dword [ebp + 0x18], 0
je 0x42f8b7
cmp dword [ebp + 0x1c], 0
je 0x42f8b7
push edi
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x10], ecx
call fcn.004b8ff0
push edi
call fcn.004b9160
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0x14]
add esp, 8
test edx, edx
je 0x42f903
push edi
push ebx
push esi
call fcn.004b9090
add esp, 0xc
mov ebx, eax
mov eax, dword [ebp + 0x14]
mov dword [eax], ebx
cmp ebx, 0xffffffff
je 0x42f9ff
push 0
push edi
push 2
push 0x4d2648
call fcn.004b9050
add esp, 0x10
mov edx, dword [ebp + 0x14]
mov edi, dword [ebp - 0xc]
mov byte [ebx + esi], 0xa
mov ebx, dword [ebp - 8]
mov esi, dword [ebp - 4]
inc dword [edx]
mov eax, 1
mov esp, ebp
pop ebp
ret
push 0
mov dword [ebp - 0x10], ecx
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp + 0x24]
mov edi, dword [ebp + 0x14]
test edx, edx
mov dword [edi], 0
je 0x42f92b
mov edi, dword [edx + 0x134]
test edi, edi
jne 0x42f930
mov edi, 0x20000
cmp ebx, edi
jbe 0x42f968
cmp dword [ebp + 0x20], 0
je 0x42f968
test edx, edx
je 0x42f948
mov edi, dword [edx + 0x134]
test edi, edi
jne 0x42f94d
mov edi, 0x20000
mov dword [ebp - 0x14], ebx
mov ebx, ecx
push 0
lea eax, [ebp - 0x10]
push eax
push edi
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp eax, 1
je 0x42f9bc
jmp 0x42f97f
lea edx, [ebp - 0x10]
push 0
push edx
push ebx
push esi
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov edx, dword [ebp - 0x10]
mov ecx, dword [ebp + 0x14]
mov dword [ecx], edx
mov ebx, dword [ebp - 8]
mov esi, dword [ebp - 4]
mov edi, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret
mov edi, ecx
mov edx, 1
jmp 0x42f896
mov dword [ebp - 0x10], ecx
call fcn.004b9280
mov ecx, dword [ebp - 0x10]
mov edi, eax
cmp dword [0x4fb140], 0
je 0x42f8bb
mov edx, 1
jmp 0x42f890
mov edx, dword [ebp - 0x10]
mov ecx, dword [ebp + 0x14]
sub dword [ebp - 0x14], edx
add dword [ecx], edx
add esi, edx
cmp dword [ebp + 0x24], 0
je 0x42f9dc
mov ecx, dword [ebp + 0x24]
mov ecx, dword [ecx + 0x134]
test ecx, ecx
jne 0x42f9e1
mov ecx, 0x20000
cmp ecx, dword [ebp - 0x14]
jb 0x42f9ef
mov edi, dword [ebp - 0x14]
test edi, edi
jne 0x42f9f5
jmp 0x42f97f
cmp dword [ebp - 0x14], 0
je 0x42f97f
test edx, edx
jg 0x42f952
jmp 0x42f97f
mov ebx, dword [ebp - 8]
mov esi, dword [ebp - 4]
mov edi, dword [ebp - 0xc]
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x43e580
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], edi
mov ebx, eax
mov eax, dword [ebx + 0x38]
mov edi, dword [ebx + 0x40]
mov edx, dword [ebx + 0x134]
sub edi, eax
test edx, edx
mov ecx, edx
jne 0x43e5a7
mov ecx, 0x20000
cmp edi, ecx
ja 0x43e5d3
lea edx, [ebp - 8]
push 0
push edx
push edi
push eax
push dword [ebx + 0xdc]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, 0xffffffff
test eax, eax
je 0x43e648
mov ecx, 1
jmp 0x43e648
mov dword [ebp - 0x18], edi
mov ecx, edi
mov dword [ebp - 0x14], esi
test edx, edx
jne 0x43e5e4
mov edx, 0x20000
mov edi, eax
mov esi, ecx
mov dword [ebp - 4], edx
push 0
lea edx, [ebp - 8]
push edx
push dword [ebp - 4]
push edi
push dword [ebx + 0xdc]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x43e612
mov edi, dword [ebp - 0x18]
mov esi, dword [ebp - 0x14]
mov ecx, 0xffffffff
jmp 0x43e648
mov eax, dword [ebp - 8]
mov edx, dword [ebx + 0x134]
add edi, eax
sub esi, eax
test edx, edx
jne 0x43e628
mov edx, 0x20000
cmp esi, edx
jae 0x43e635
mov dword [ebp - 4], esi
test esi, esi
jne 0x43e639
jmp 0x43e63d
test esi, esi
je 0x43e63d
test eax, eax
ja 0x43e5eb
mov edi, dword [ebp - 0x18]
mov esi, dword [ebp - 0x14]
mov ecx, 1
mov edx, dword [ebx + 0x38]
mov eax, dword [ebx + 0xf0]
and byte [ebx + 0x165], 0xfb
mov dword [ebx + 0x40], edx
add edx, eax
mov dword [ebx + 0x44], edx
xor eax, eax
mov dword [ebx + 0xa8], eax
mov dword [ebx + 0xac], eax
mov eax, edi
cdq
mov eax, dword [ebx + 0xc0]
add edi, eax
adc edx, dword [ebx + 0xc4]
mov dword [ebx + 0xc0], edi
mov dword [ebx + 0xb8], edi
mov dword [ebx + 0xc4], edx
mov dword [ebx + 0xbc], edx
cmp ecx, 0xffffffff
je 0x43e6a8
mov ebx, dword [ebp - 0xc]
mov edi, dword [ebp - 0x10]
xor eax, eax
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, dword [ebp - 0x10]
mov dword [ebx + 0xe0], eax
mov ebx, dword [ebp - 0xc]
mov eax, 0x26
mov esp, ebp
pop ebp
ret
Function at 0x475040
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4eee84]
jne 0x47504a
repz ret
jmp fcn.0048a350

Function at 0x47c5f0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
xor eax, eax
cmp dword [ebp + 8], 0
setne al
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x47c628
push str._path___NULL_
push 0
push 0x50
push str.f:dd_vctoolscrt_bld_self_x86crt_src_access.c
push 2
call fcn.0046caf0
add esp, 0x14
cmp eax, 1
jne 0x47c628
int3
cmp dword [ebp - 8], 0
jne 0x47c669
call fcn.004663c0
mov dword [eax], 0
call fcn.00466390
mov dword [eax], 0x16
push 0
push 0x50
push str.f:dd_vctoolscrt_bld_self_x86crt_src_access.c
push str._access_s
push str._path___NULL_
call fcn.0046c530
add esp, 0x14
mov eax, 0x16
jmp 0x47c741
mov edx, dword [ebp + 0xc]
and edx, 0xfffffff9
neg edx
sbb edx, edx
add edx, 1
mov dword [ebp - 0xc], edx
jne 0x47c699
push str.__amode___6____0_
push 0
push 0x51
push str.f:dd_vctoolscrt_bld_self_x86crt_src_access.c
push 2
call fcn.0046caf0
add esp, 0x14
cmp eax, 1
jne 0x47c699
int3
cmp dword [ebp - 0xc], 0
jne 0x47c6d7
call fcn.004663c0
mov dword [eax], 0
call fcn.00466390
mov dword [eax], 0x16
push 0
push 0x51
push str.f:dd_vctoolscrt_bld_self_x86crt_src_access.c
push str._access_s
push str.__amode___6____0_
call fcn.0046c530
add esp, 0x14
mov eax, 0x16
jmp 0x47c741
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x47c702
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00466180
add esp, 4
call fcn.00466390
mov eax, dword [eax]
jmp 0x47c741
mov edx, dword [ebp - 4]
and edx, 0x10
je 0x47c70e
xor eax, eax
jmp 0x47c741
mov eax, dword [ebp - 4]
and eax, 1
je 0x47c73f
mov ecx, dword [ebp + 0xc]
and ecx, 2
je 0x47c73f
call fcn.004663c0
mov dword [eax], 5
call fcn.00466390
mov dword [eax], 0xd
call fcn.00466390
mov eax, dword [eax]
jmp 0x47c741
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x44165c
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
pushal
sbb eax, eax
bts dword [0x443bc6], 0xd
push edx
pop dword [0x443f2d]
xor byte [0x443e93], 7
je 0x441698
imul edi, eax, 0x1849c16d
dec ecx
rol ch, 6
add dword [0x443c5c], 0x4f829afe
mul eax
mov eax, edx
movsx edx, ax
test edi, eax
jne 0x4416fa
xor dword [0x443c92], 0x3724e3c3
adc edi, edx
dec ebx
sub dword [0x443e50], 0xffffffd6
shrd dword [0x443e7e], eax, 0x1d
imul eax, eax
or ch, 0xd
sub dword [0x443ed1], eax
shld eax, edx, 0x1f
or word [0x443c65], ax
push edx
pop dword [0x443c3c]
rol edx, 1
add ecx, 0x4c
or edx, eax
adc dword [0x443d9a], 9
adc al, dl
movsx eax, word [0x443dc8]
movsx ebx, byte [0x443e1d]
add edx, 0x51a61dcd
xor dword [0x443c08], edx
mov ecx, esi
and esi, dword [0x443cae]
or edx, dword [0x443ee4]
lea ecx, [ebp - 4]
add dl, al
push ecx
sbb dword [0x443dde], 0x4808a18d
imul ebx, dword [0x443b75]
push dword [ebp + 0x14]
and dword [0x443ccf], edx
not edi
mov ecx, dword [ebp + 0x10]
shl ecx, 2
shld edx, eax, 0x1e
add dword [0x443c53], 0x182a566a
mov dword [0x443f92], 0x79056956
not dword [0x443f07]
mov edi, dword [ebp + 8]
rol esi, 9
seto byte [0x443d51]
xchg esi, ecx
xor edi, 0x7275745c
sbb ah, dl
mov ecx, esi
add ecx, edi
adc dword [0x443c20], 0x3241fda4
push edx
or ebx, 0xffffff96
sar esi, 1
imul bx, dx
mul eax
movzx esi, dx
sub dword [0x443ddd], 0x71b7a4fd
pop edx
or dl, 0x5d
push ecx
mov ah, byte [0x443c60]
dec eax
call fcn.00450f94
mov dword [0x443cd6], edx
inc edx
sar edx, 0xd
mov ecx, dword [ebp + 0x10]
and byte [0x443d6c], dl
neg ebx
shl ecx, 2
movsx edi, word [0x443ead]
add ecx, dword [ebp + 0xc]
mul edx
bsf edx, dword [0x443e7e]
and edx, 0xffffff80
push dword [ebp - 4]
mov esi, 0x443f8f
mov dword [esi], 0x5577229b
inc dword [0x443d7f]
bsr edi, edx
inc byte [esi]
sub bh, byte [esi]
push 0x68ddc238
pop dword [0x443caf]
mov ebx, 0x443dd8
or eax, 0x18b4899c
dec dword [ebx]
mov edi, edx
movsx edx, word [ebx]
movzx edx, byte [ebx]
pop dword [ecx]
mov eax, ecx
or edx, eax
sar esi, 8
dec dword [ebp + 0x10]
js 0x4418de
mov dword [0x443b9d], 0x7bab99b8
movzx ebx, dx
push dword [ebp + 0x14]
push dword [0x443bc6]
pop dword [0x443ea5]
push dword [ebp + 0x10]
sbb bh, 0xbe
sub byte [0x443c67], 0xb2
mov dword [0x443d0b], eax
push dword [ebp + 0xc]
sbb edx, 0x59
push dword [ebp + 8]
inc dword [0x443bb7]
shl dword [0x443c8a], 0x1f
call fcn.0044e18d
push edx
inc ecx
mov dword [0x443f9b], edx
mov dword [0x443d7b], 0x71b91867
mov dword [0x443dbf], eax
xor cl, dl
mov di, dx
and byte [0x443bdf], dl
mov esi, dword [0x443ef8]
adc ecx, 0x7ad78439
push dword [0x443c33]
pop dword [0x443c89]
add dword [0x443e6d], 0xffffffa2
or byte [0x443e38], dl
sub dword [0x443b82], 0xecc640
mov dword [0x443f2f], 0x74015bfc
sub cl, 0x3c
bts dword [0x443d48], 0x16
setge dl
pop edx
mov dword [0x443f83], eax
movsx ecx, word [0x443cb0]
sub cx, 0x20ff
setno byte [0x443def]
movzx ecx, ax
popal
mov esp, ebp
pop ebp
ret 0x10
Function at 0x441efa
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
pushal
dec dword [0x443cfb]
sub word [0x443ca9], 0xff8e
mov eax, edx
call fcn.0044f301
movzx edi, dx
shl ecx, 1
and bh, dl
adc eax, 0x10
inc dword [0x443eac]
dec dword [0x443ef3]
and ecx, 0xffffff92
jne 0x441f45
movsx ecx, dx
mov dword [0x443bee], edx
and ebx, 0xc8f79dd
imul ecx, eax
rol esi, 1
movsx eax, word [0x443b86]
popal
mov esp, ebp
pop ebp
ret

Function at 0x441f51
Capabilities:
Packed with generic packer

Disassembly:
pushal
cmp cl, byte [0x443cf4]
jno 0x441f63
not ecx
movsx edx, byte [0x443df8]
imul ecx, eax, 0x44847f12
shld edx, eax, 8
rcr esi, 4
test al, 0x72
je 0x441fe1
or bh, 0xb2
or eax, 0xffffffa4
movsx edx, dl
shrd esi, edx, 0xf
push dword [0x443eb0]
push dword [0x443d2a]
push dword [0x443d09]
push 0x2736671e
push dword [0x443c84]
dec dword [0x443f90]
jne 0x441fdc
setb byte [0x443c30]
imul eax
dec byte [0x443dac]
xor edx, 0x291dbf46
push dword [0x443e07]
pop dword [0x443c73]
adc dword [0x443e5c], 0xffffff92
sub byte [0x443c98], 0xd4
movsx ecx, word [0x443b1c]
call fcn.0044f3c4
mov dword [0x443ef2], 0x5f6db255
popal
ret

Function at 0x44bb68
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov dword [ebp + 0x10], 0x39016ca8
add byte [0x443d75], 0xe6
movsx ecx, dx
mov eax, 0x1a
sub ecx, eax
add dword [eax*4 + 0x443df0], 0x2bcddba2
xor dword [0x443c4c], 0x5bf6c7b7
adc ecx, eax
setne byte [ebp + 0x10]
add bh, 0xea
push edx
pop dword [0x443bab]
and dword [eax*4 + 0x443cc6], 0x5e
movzx edi, ax
add dword [0x443d27], 0xfffffffc
add di, 0xffc1
mov edi, dword [ebp + 0x10]
push edx
pop dword [ebp + 0x14]
add ecx, eax
and ebx, eax
xor ecx, 0x1211ca73
dec eax
jns 0x44bb81
mov ebx, 0x443d27
mov byte [ebp + 0x14], dl
adc eax, dword [0x443dfc]
sub edi, 0x377f6c72
or eax, dword [ebp + 0xc]
or edx, 0x488aba52
ror cx, 0
xor eax, 0x5a3a4c3
movsx ecx, ax
movsx esi, ax
xor edi, edx
add dword [ebx], 0x459e7c0
dec edx
add ecx, dword [0x443c0d]
adc dh, 0xfb
sete byte [ebp + 0x10]
sbb ah, dl
movsx edi, al
test edx, 0x5b377dea
je 0x44bc59
and edi, dword [ebx]
sub dword [ebx], 0x4d9f7664
and eax, 0x26262e84
shld esi, edx, 0x19
mov cx, ax
bts dword [ebp + 0x10], 0x11
push dword [0x443c77]
pop dword [0x443f57]
mov dword [0x443e9a], eax
sub dword [ebp + 0xc], 0xffffff88
add ecx, 0x57
and dword [ebp + 0xc], 0x65e0e2d4
pop ebp
ret 0x10
Function at 0x44eeda
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
pushal
dec ecx
mov edx, 0x1c0d8d08
dec ecx
bsr ecx, dword [0x443d26]
sets byte [0x443c77]
mov dword [0x443da1], 0x16c0bcb6
lea ebx, [ebp - 4]
neg byte [0x443ecc]
xchg ecx, ebx
push ecx
push dword [ebp + 0x14]
rcr eax, 1
add byte [0x443e2e], 0x9e
mov edi, 0x7b0615c3
mov ecx, dword [ebp + 0x10]
add dx, 0x5a
adc eax, 0x61cde1b9
mov dword [0x443c70], 0x176c4d1e
shl ecx, 2
add ebx, eax
mov di, 0x552b
mov edi, dword [ebp + 8]
mov dword [0x443d9b], eax
mov byte [0x443c58], al
rol dword [0x443bb8], 0x11
xor edi, 0x7275745c
movsx ebx, ax
add ecx, edi
mov ebx, eax
and edx, 0xffffffca
inc esi
mov edx, ecx
push edx
call fcn.0044fd68
shr word [0x443e03], 0xa
mov edx, dword [ebp + 0x10]
dec dword [0x443f07]
shl edx, 2
dec di
mov byte [0x443e40], dl
setne byte [0x443c4d]
add edx, dword [ebp + 0xc]
and ebx, 0xffffff91
movzx ecx, dx
adc dword [0x443c1e], 0xffffff81
push dword [ebp - 4]
movsx esi, word [0x443cc5]
pop dword [edx]
or dword [0x443dbb], eax
sar bx, 1
mov ah, 0xf9
dec dword [ebp + 0x10]
js 0x44efe8
dec ecx
push dword [ebp + 0x14]
movzx edi, ax
and ah, dl
and edi, 0x5a
push dword [ebp + 0x10]
add dword [0x443e86], eax
push dword [ebp + 0xc]
add eax, edx
push dword [ebp + 8]
adc ebx, edx
or eax, edx
cmc
call fcn.0044165c
sub ebx, 0x42
sbb esi, 0x52269496
and al, 0x3c
mov ch, dl
call fcn.0044fb30
mov ecx, eax
popal
mov esp, ebp
pop ebp
ret 0x10
Function at 0x44f901
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
pushal
mov ebx, 0x60b1d2a1
mov edx, 0x694313b9
adc eax, 0xffffffbe
call fcn.0045173a
shr ecx, 1
seta byte [ebp + 0xc]
sub dword [ebp + 0xc], 3
ror eax, 2
adc edi, edx
not word [0x443bae]
btc dword [ebp + 0xc], 0x19
dec dword [0x443e5b]
js 0x44f948
imul edi, dword [0x443cc0]
sbb esi, 0x19
shld ebx, eax, 0xe
xor dword [ebp + 0xc], 0x72
shr edi, 1
adc dword [ebp + 8], eax
and eax, edx
xor esi, dword [ebp + 8]
xor byte [0x443f4f], 0xd6
seto byte [ebp + 8]
mov eax, 0x3fcf6d41
sub dword [ebp + 0xc], eax
xor ebx, 0x58
setge byte [ebp + 8]
mov ecx, 0xb
xor esi, eax
call fcn.0044ea30
xor byte [ebp + 0xc], al
sub edi, 0x67
imul esi, dword [0x443eed], 0xa4be0ba
adc dh, 0x7d
mov dword [ecx*4 + 0x443cbc], 0x2be9959f
rcr byte [ebp + 0xc], 1
mov eax, 0x1c5e54d7
push dword [ebp + 0xc]
push 0x16690d78
push 0x12c2489c
push edx
push dword [ecx + 0x443f4c]
mov edi, 0x12
sub dword [ebp + 0xc], eax
and edx, 0x7b197710
add esi, 0x50bc4d4a
inc esi
mov edx, eax
push dword [ebp + 0xc]
pop dword [edi + 0x443db2]
adc dword [0x443c07], edx
dec esi
not dword [ebp + 0xc]
mov bl, 0xb1
mul eax
push dword [ebp + 8]
push 0x3a33423
push dword [ebp + 8]
sub esi, eax
push dword [0x443f12]
push dword [edi + 0x443eca]
or edx, eax
call fcn.0044f3c4
movzx eax, dx
push dword [0x443e3b]
movsx edx, dx
push dword [ebp + 0xc]
mov esi, 0x6ca8da2d
push dword [ebp + 0xc]
push dword [0x443dd7]
push dword [0x443e92]
call fcn.0044f3c4
dec edi
jne 0x44f9bb
push 0x3e3e8e74
push dword [ebp + 0xc]
push dword [0x443f54]
push dword [ebp + 0xc]
push dword [ebp + 8]
mov eax, edx
push dword [0x443f6d]
push 0x2a958ea9
call fcn.0044f19f
add esp, 0x18
push 0x49e021d
sbb dword [ebp + 8], 0x5a8d543c
call fcn.004418f4
sbb byte [ebp + 0xc], 0x33
mov edi, eax
popal
pop ebp
ret 8
Function at 0x450651
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
pushal
bt esi, eax
not word [0x443c87]
cmp byte [0x443f6a], dl
js 0x4506c4
sbb edx, dword [ebp - 4]
add edi, 0x64
imul eax
call fcn.0044196b
btc dword [0x443c1e], 0x1a
push dword [0x443ea7]
pop dword [0x443d2c]
dec ecx
push dword [0x443d5f]
push edx
push dword [0x443b8e]
push edx
push dword [0x443e89]
push 0x6ad171e1
setae byte [ebp + 0xc]
add bh, byte [0x443bf5]
call fcn.0044f267
bt dword [ebp + 0xc], 0x13
mov ebx, 0x6963e6b5
adc edx, 0x717946c
and al, byte [0x443ebb]
jne 0x450789
mov dword [0x443c9a], edx
mov esi, 2
or ah, byte [ebp - 8]
shld dword [0x443d5d], edx, 7
mov dword [0x443d46], 0x51779129
xor ax, 0x53
bts eax, edx
imul dx, dx, 0x62e9
mov eax, 0xbebe741
imul ebx, dword [ebp + 0xc]
sbb dword [0x443dea], 0x52b07e5f
mov eax, 0x26280eda
mov cl, byte [ebp - 8]
or ecx, 0x72fcf125
bsf ebx, eax
sub dword [0x443f5f], 0xffffffde
and byte [ebp - 8], al
adc ebx, 0x50
movzx edi, al
shr ecx, 1
sub ax, 0x41
add ecx, edx
or dword [ebp - 8], eax
shld dword [0x443f5e], edx, 0x14
and dl, al
jne 0x450789
shld edx, eax, 0x1c
setle byte [0x443d62]
mov dh, al
or dword [0x443e19], eax
setge al
push eax
or ebx, dword [0x443c36]
je 0x450788
bts eax, edx
imul eax, dword [ebp - 4], 0x32150cc4
movsx eax, word [0x443de7]
mov eax, edx
ror bl, 2
imul ebx, eax, 0x3e20efbc
dec dword [0x443ee3]
pop eax
setge byte [0x443cac]
popal
mov esp, ebp
pop ebp
ret 8
Function at 0x417460
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0xd000]
push edi
or ebp, 0xffffffff
jmp 0x417482
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x417489
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x417478
mov eax, 1
add ebx, ebx
jne 0x41749b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x417490
jne 0x4174ac
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x417490
xor ecx, ecx
sub eax, 3
jb 0x4174c0
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x417532
mov ebp, eax
add ebx, ebx
jne 0x4174cb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x4174d8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x4174fc
inc ecx
add ebx, ebx
jne 0x4174e8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x4174dd
jne 0x4174f9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4174dd
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x41751c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x41750d
jmp 0x41747e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x41751c
add edi, ecx
jmp 0x41747e
pop esi
mov edi, esi
mov ecx, 0x463
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x41753a
cmp byte [edi], 7
jne 0x41753a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x41753f
lea edi, [esi + 0x15000]
mov eax, dword [edi]
or eax, eax
je 0x4175ae
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x17000]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x17028]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x41756c
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x17030]
or eax, eax
je 0x4175a8
mov dword [ebx], eax
add ebx, 4
jmp 0x417589
call dword [esi + 0x1702c]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x4175df
cmp al, 0xef
ja 0x4175d2
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x4175b4
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x4175c1
mov ebp, dword [esi + 0x17034]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x217]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x417613
sub esp, 0xffffff80
jmp 0x401344
Function at 0x401b66
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x410004]
jne 0x401b70
repz ret
jmp fcn.0040324d

Function at 0x4028f2
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
pushal
call 0x402901
pop dword [ebp - 8]
mov eax, 0x29e0cbc3
add eax, 0xd65f5d3e
sub dword [ebp - 8], eax
mov dword [ebp - 0x18], 0xff20fad9
add dword [ebp - 0x18], 0x4f314a72
mov dword [ebp - 0x14], 0x5484c2a6
sub dword [ebp - 0x14], 0x22517661
mov dword [ebp - 0x10], 0x7b6fdad0
add dword [ebp - 0x10], 0xd0dc695e
mov dword [ebp - 0xc], 0x1442b5b7
sub dword [ebp - 0xc], 0x1442b5b7
lea eax, [ebp - 0x18]
push eax
mov eax, 0xca77c3c5
sub eax, 0xca36f379
add eax, dword [ebp - 8]
call dword [eax]
mov dword [ebp - 0x18], 0x32d396f9
add dword [ebp - 0x18], 0x419ed25d
mov dword [ebp - 0x14], 0xa9ac9d1c
sub dword [ebp - 0x14], 0x68403ba7
mov dword [ebp - 0x10], 0xa3d18bc5
add dword [ebp - 0x10], 0xbf9de0a7
mov dword [ebp - 0xc], 0x446a7951
add dword [ebp - 0xc], 0xbb9586af
lea ebx, [ebp - 0x18]
push ebx
push eax
mov eax, 0xf6d3d63e
add eax, 0x96cfa0a
add eax, dword [ebp - 8]
call dword [eax]
push 0x40
push 0x1000
push 0x3aebf
push 0
call eax
mov ecx, 0x1abd8c26
add ecx, 0xe542c1bb
xor ebx, ebx
add ebx, eax
mov esi, 0xefedf35
add esi, 0xf142d0cb
add esi, dword [ebp - 8]
mov edx, 0x2373bcde
add edx, 0x601c5b92
add dword [ebp - 4], ebx
mov edi, dword [esi]
sub dword [ebp - 4], 0xff4576df
xor edi, edx
add dword [ebp - 4], ecx
mov dword [ebx], edi
mov dword [ebp - 4], 0x276529a7
add ebx, 0x38a21dc8
sub ebx, 0x38a21dc4
add esi, 4
loop 0x402a25
add eax, 0xca52b4b7
sub eax, 0xca518a60
xor ebx, ebx
add ebx, eax
add eax, 0x67a0f733
sub eax, 0x67a0f72e
mov ecx, 0xfc9313bd
add ecx, 0x3acec43
invalid
invalid
clc
invalid