joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42841a
Capabilities:
Encode data using xor

Disassembly:
mov dword [0x234afd2d], eax
invalid
mov al, byte [0xde28c83b]
aas
xlatb
mov byte [edx - 0x30], cl
sbb al, 0xda
cmpsd dword [esi], dword es:[edi]
lodsd eax, dword [esi]
cli
insb byte es:[edi], dx
fcomp dword [ebp - 0x204a4847]
daa
xor ah, byte [ebp + 0x27]
and al, 0x4c
ror dword [edi], 1
and dword [0x14df6f80], eax
sahf
xchg esp, eax
sub al, 0x5e
insd dword es:[edi], dx
lodsb al, byte [esi]
xor al, 0x23
rol byte [edx], 1
cmpsd dword ds:[esi], dword es:[edi]
stc
js 0x428412
and dl, byte [0x56079f2e]
mov al, byte [0x52679cb4]
loop 0x428405
mov ebx, 0xece4b194
imul byte [eax + esi*2 + 0x55]
pop esp
add edx, edi
adc al, 0x3a
pop edi
jl 0x42837d
sti
invalid
inc edi
sbb byte [ebx - 0x796c1b32], 0x5f
enter 0xffffffffffffb553, 0xffffffffffffffca
jle 0x4283a5
mov ss, word [ecx - 0x772a07e8]
scasb al, byte es:[edi]
cmp ch, cl
pushfd
mov ebx, 0xabe3b5d7
and al, 0x79
jle 0x4283b4
sub byte [ecx - 0x6c84acb0], 0xee
insb byte es:[edi], dx
or eax, 0xb18d9a63
mov ecx, es
pop es
and al, 0x3b
cmpsd dword [esi], dword es:[edi]
push esi
mov dl, 0x87
invalid

Function at 0x429178
Capabilities:
Encode data using xor

Disassembly:
movsb byte es:[edi], byte [esi]
aaa
call 0x518ba985
rcl al, 1
pop es
xchg edx, eax
adc byte [eax + 0x777f990d], dl
dec eax
mov esp, 0x54f16e39
sub byte [ebp - 0x54], dh
jp 0x42916b
or byte [ecx - 0x2b96353a], ch
xor eax, edi
and dl, dh
push ds
dec eax
xchg byte [esi + 0x1d], bh
sahf
lahf
ret 0x1f7b
fdiv dword [ebx + eax*4]
outsd dx, dword [esi]
cmpsd dword [esi], dword es:[edi]
push ss
xor al, 0xa0
invalid
push 0xbcdbe9b4
cdq
ja 0x429106
add bl, byte [eax + 0x62]
xlatb
dec eax
sub ecx, dword [ebp - 0x32]
js 0x4291dc
cmpsb byte [esi], byte es:[edi]
cmp eax, ecx
push edx
pop edx
or esi, dword [ebp - 0x10]
adc dl, byte [ebx]
push edi
sub dword [ecx], esp
cmp al, byte [edx + 0x39b9e659]
test al, 0x4c
test al, 0x19
dec ebx
jg 0x4291d0
dec eax
cmp eax, 0x54b37b05
cmp dword [edx + ebx - 0x1b95749e], esp
pushal
sbb edi, edx
cmpsd dword [esi], dword es:[edi]
mov edi, 0xd1cbed27
cli
xchg esp, eax
and dl, byte [edi - 0x63a0c2cd]
xchg esp, eax
stc
invalid
sub dword [edi], esi
and ecx, dword [ebx + 0x44]
push eax
mov ch, 0xea
dec esp
mov eax, 0x96c2a5d
fimul word [edi]
and eax, 0x2bf23baf
mov bl, byte [edi + 0x540d4420]
sub ch, byte [ecx + ecx - 0x22]
invalid
lahf
and byte [ebp + ecx + 0x54], al
xor edx, dword [ebp - 0x7569e936]
pop edx
test al, 0x4f
inc ebx
pop eax
xchg edi, eax
out dx, eax
mov dword [eax], ecx
pop ebp
fidivr dword [ebx]
neg dword [edi - 0x40ee0a99]
cmpsd dword [esi], dword es:[edi]
pop ecx
mov al, byte [ebp + 0x3d]
xor byte [edx - 0x41], 0x25
mov ebx, ecx
stosd dword es:[edi], eax
adc ah, byte [esi + 0x16]
rcpps xmm5, xmmword [ebx - 0x644bd69d]
jl 0x4291e7
fist word [eax]
Function at 0x436f6c
Capabilities:
Check for vm using instruction vpcext

Disassembly:
sar byte [ecx - 0x56cc2cf0], 0x62
pop esp
clc
pop esp
dec esp
fldenv [esi - 0x5fc5a9e9]
aad 0x87
fnstenv [ebp - 0x5f]
add byte [edi - 0x54d2d3b0], cl
mov bl, byte [ebx + 0x72]
sub eax, 0x4b435791
adc bl, ch
mov dword [ecx + 0x3fe069e3], ebp
mov bl, 0x4c
push cs
xchg ebp, ecx
sub al, byte [ebp + 0x64e899b0]
mov dl, 0xdd
pop ecx
ror byte [eax - 0x607f2c5], cl
clc
leave
pop eax
xor dword [eax + 0x47], ebp
out 0xbd, eax
pop eax
push 0x58bde747
jae 0x436f2a
add al, 0xd7
or dword [ebx], ebp
sbb al, 0x6f
add byte [edi + 0x3f], cl
mov eax, 0x9027635c
pop ss
daa
fidiv word [edx + eax*4 + 0x5abed126]
shr byte [ebx + 0x5628fa54], 0xd8
mov ch, ch
mov eax, ds
lds edi, [edx]
insb byte es:[edi], dx
cwde
imul eax, dword [ebx + edx*2 + 0x77644978], 0x991d29ce
cdq
pop eax
test dword [eax], ebp
xor edi, dword [edx]
leave
push cs
aad 0xd2
sbb ebx, eax
sbb eax, 0x49816b17
pop eax
pop ecx
scasb al, byte es:[edi]
mov edi, 0xb8518a1a
fldcw word [eax - 0x38]
mov ah, byte fs:[edx + 0x70]
cmp dword [eax + 0x2b], edi
jns 0x437003
wait
insd dword es:[edi], dx
xchg esi, eax
pop ebp
js 0x436f6e
mov esp, 0xf943c3c
aas
int3
mov esi, 0xa0593950
inc ebx
stc
js 0x436fa5
jnp 0x437017
call 0x627ce711
inc ebx
cdq
std
invalid
or dword [esi - 0x29137583], ebx
push ds
sub edi, ecx
enter 0x7eb9, 0xffffffffffffffaf
pop ds
frndint
invalid

Function at 0x4459a6
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x38
mov eax, dword [0x581a60]
xor eax, esp
mov dword [esp + 0x34], eax
mov ecx, dword [esi + 0x20]
push ebx
push edi
lea eax, [esp + 0x2c]
xor edi, edi
push eax
push ecx
mov dword [esp + 0x34], edi
mov dword [esp + 0x38], edi
mov dword [esp + 0x3c], edi
mov dword [esp + 0x40], edi
call dword [0x536724]
fld qword [esi + 0x88]
mov eax, dword [esp + 0x34]
fmul qword [0x560e70]
mov ebx, dword [esp + 0x38]
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x30]
mov dword [esp + 0x28], ebx
mov dword [esp + 0x18], ebx
lea ebx, [eax - 0x50]
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x14], eax
mov dword [esp + 0x20], edx
mov dword [esp + 0x24], eax
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x1c], ebx
call 0x558276
mov dword [esp + 0x28], eax
mov dword [esp + 0x18], eax
cmp dword [esi + 0x7c], edi
jg 0x445a6e
Function at 0x445ac7
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [esi + 0x7c]
lea edx, [eax + eax*4]
add edx, edx
add edx, edx
mov dword [esp + 8], edx
fild dword [esp + 8]
fmul qword [esi + 0x88]
call 0x558276
mov ecx, dword [esp + 0x3c]
pop edi
pop ebx
xor ecx, esp
call 0x551f51
mov esp, ebp
pop ebp
ret
mov eax, dword [esp + 0x18]
mov ebx, dword [esp + 0x14]
test edi, edi
js 0x445b14
cmp edi, dword [esi + 0x7c]
jge 0x445b14
mov edx, dword [esi + 0x78]
mov ecx, dword [edx + edi*4]
mov edx, dword [esp + 0x10]
push 1
sub eax, edx
push eax
mov eax, dword [esp + 0x14]
sub ebx, eax
push ebx
push edx
mov dword [esp + 0x18], ecx
push eax
add ecx, 0x138
call fcn.0045a3b8
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x24]
push 1
sub ecx, eax
push ecx
mov ecx, dword [esp + 0x24]
sub edx, ecx
push edx
push eax
push ecx
mov ecx, dword [esp + 0x1c]
call fcn.0045a3b8
add dword [eax], eax
add dword [eax], eax
fld qword [esi + 0x88]
fmul qword [0x560e70]
call 0x558276
mov ebx, dword [0x536728]
push eax
push 0
lea eax, [esp + 0x14]
push eax
call ebx
fld qword [esi + 0x88]
fmul qword [0x560e70]
call 0x558276
push eax
push 0
lea ecx, [esp + 0x24]
push ecx
call ebx
inc edi
cmp edi, dword [esi + 0x7c]
jl 0x445a66
jmp 0x445a36
call fcn.0045e5df
int3
Function at 0x488b73
Capabilities:
Encode data using xor

Disassembly:
invalid
sub dl, byte [edi - 0x341364f6]
aaa
stc
lahf
invalid
mov eax, es
jno 0x488b0e
push ebp
jb 0x488bf3
mov esi, dword [eax + 0x75ea37f1]
sub al, 0x21
or esi, dword [ecx]
jecxz 0x488b1b
ljmp 0x4b1:0x5aee8e30
pop ebp
sub ebp, dword [edi + 0x74]
mov gs, word [ebp - 0x76acbe25]
fidiv word [0xe6130a65]
fild dword [ecx + 0x53]
mov esi, ebx
xor eax, 0xe6130a65
arpl si, dx
salc
or bh, byte [esi + 0x56048f7d]
fst st(5)
pop ebx
add dh, byte [esp + eax]
outsd dx, dword [esi]
add al, 0x6f
dec ebx
or al, 0xe4
loope 0x488bdf
in al, 0xe1
in eax, 0x4b
dec ebx
dec edx
sbb dword [edi], esp
and byte [edx], cl
push 0xffffffffffffffac
jo 0x488c6d
jle 0x488bdc
sub bh, byte [ebx - 0xfcd8164]
jl 0x488bfc
call [ecx]
push edx
sub dh, byte [0xf1402310]
test eax, 0xbf0fa57e
adc eax, 0x4ae3b7f4
dec esi
sbb bl, dh
bound eax, qword [esi + eax*8]
fstp xword [ecx]
pop ebx
push ecx
pop edx
pop ecx
cld
enter 0xffffffffffffc407, 4
repne scasb al, byte es:[edi]
adc eax, 0x609db3a5
mov ecx, 0x67c80739
jp 0x488c7d
mov bl, ch
jmp 0x488c54
ja 0x488bd6
ficom dword [ecx - 0x42]
dec edx
pop ebp
rol byte [esi], 1
add eax, 0x53d3575
jp 0x488be7
mov word [edi - 0x4e9406a6], ds
jno 0x488bf7
ja 0x488c97
sub dword [edx + eax*4 - 0x614ffa40], ebx
pushfd
add al, 5
mov al, 0x9e
out dx, eax
and dh, bl
dec eax
shl byte [esi], cl
fidivr word [edx - 0xb13153d]
mov edi, 0x9ffb9471
pop eax
ljmp 0xfb94:0x71bff4ec
push edx
xchg ebx, eax
sbb eax, 0x2fc03b41
xchg esp, eax
xlatb
sti
xchg ebx, eax
cmp ch, dl
mov bl, 0xbb
mov edx, 0x4ba58559
cld
push esi
in eax, dx
test dword [ebp - 0x12a903b5], esp
jp 0x488c56
jecxz 0x488cb9
sub al, byte [edx - 0x9ce4072]
pop esi
insd dword es:[edi], dx
adc al, 0xd7
sub ebp, dword [esi]
jle 0x488c86
cmp ch, cl
cmp eax, dword [edx + ebp*2]
or byte [edi + ebx*8 + 0x7b], ah
cmp esp, 0xffffff95
cld
xchg ebp, eax
add eax, 0xed44404a
sahf
jl 0x488c59
pop edx
mov byte [eax + 0x576bb73f], al
adc eax, 0x544fdec2
pushfd
test al, 0xc1
cmp cl, byte [ebp + edx*8 - 0x5b]
xor bh, byte [ebx]
sbb ch, al
push cs
mov byte [0x97af8a2d], al
scasd eax, dword es:[edi]
sbb al, 0x4d
add cl, ch
ret

Function at 0x48930e
Capabilities:
Encode data using xor

Disassembly:
outsb dx, byte [esi]
out 0x60, eax
and eax, 0xa881d0f3
fistp word [edi]
jns 0x4892cd
jecxz 0x48932b
lock xor edx, dword [eax - 0x46]
add dword gs:[ebx + 0x7a33cfc0], 0x6782194e
iretd
sub eax, 0xdecaa774
fstp qword ds:[0xee950e01]
pop ecx
out 0xf6, al
dec ecx
pop es
jne 0x489324
and eax, ebp
int 0x59
and dword [esi + 0x5a200132], 0x428e81d6
fldenv [ebp + 0x3072ab33]
out 0x26, al
cld
invalid

Function at 0x489767
Capabilities:
Encode data using xor

Disassembly:
mov ax, dx
mov edi, 0xe43fbd96
in eax, 0x54
sub eax, 0x526676be
add al, 0xc4
cli
les edi, [esi]
cli
stc
mov dl, 0x28
aas
mov bh, 0xe5
imul dword [esp + esi + 0x11bb0a07]
inc edx
out dx, al
aam 0xda
mov eax, dword [0xfe0195db]
in al, dx
lodsb al, byte [esi]
and al, 0x16
xor al, 0x89
scasd eax, dword es:[edi]
jb 0x489730
push ds
xchg ebx, esp
int3
push esp
sbb bx, word [edx + 0x14]
dec ebp
loop 0x48971f
out dx, eax
sahf
dec ecx
mov esp, 0x4a03d309
popfd
imul edx, dword [eax], 0xffffffca
popal
hlt
Function at 0x48a176
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x38
mov eax, dword [0x581a60]
xor eax, esp
mov dword [esp + 0x34], eax
mov ecx, dword [esi + 0x20]
push ebx
push edi
lea eax, [esp + 0x2c]
xor edi, edi
push eax
push ecx
mov dword [esp + 0x34], edi
mov dword [esp + 0x38], edi
mov dword [esp + 0x3c], edi
mov dword [esp + 0x40], edi
call dword [0x536724]
fld qword [esi + 0x88]
mov eax, dword [esp + 0x34]
fmul qword [0x560e70]
mov ebx, dword [esp + 0x38]
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x30]
mov dword [esp + 0x28], ebx
mov dword [esp + 0x18], ebx
lea ebx, [eax - 0x50]
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x14], eax
mov dword [esp + 0x20], edx
mov dword [esp + 0x24], eax
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x1c], ebx
call fcn.0059ca46
mov dword [esp + 0x28], eax
mov dword [esp + 0x18], eax
cmp dword [esi + 0x7c], edi
jg 0x48a23e
mov eax, dword [esi + 0x7c]
lea edx, [eax + eax*4]
add edx, edx
add edx, edx
mov dword [esp + 8], edx
fild dword [esp + 8]
fmul qword [esi + 0x88]
call fcn.0059ca46
mov ecx, dword [esp + 0x3c]
pop edi
pop ebx
xor ecx, esp
call fcn.00596721
mov esp, ebp
pop ebp
ret
mov eax, dword [esp + 0x18]
mov ebx, dword [esp + 0x14]
test edi, edi
js 0x48a2e4
cmp edi, dword [esi + 0x7c]
jge 0x48a2e4
mov edx, dword [esi + 0x78]
mov ecx, dword [edx + edi*4]
mov edx, dword [esp + 0x10]
push 1
sub eax, edx
push eax
mov eax, dword [esp + 0x14]
sub ebx, eax
push ebx
push edx
mov dword [esp + 0x18], ecx
push eax
add ecx, 0x138
call fcn.0049eb88
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x24]
push 1
sub ecx, eax
push ecx
mov ecx, dword [esp + 0x24]
sub edx, ecx
push edx
push eax
push ecx
mov ecx, dword [esp + 0x1c]
call fcn.0049eb88
fld qword [esi + 0x88]
fmul qword [0x560e70]
call fcn.0059ca46
mov ebx, dword [0x536728]
push eax
push 0
lea eax, [esp + 0x14]
push eax
call ebx
fld qword [esi + 0x88]
fmul qword [0x560e70]
call fcn.0059ca46
push eax
push 0
lea ecx, [esp + 0x24]
push ecx
call ebx
inc edi
cmp edi, dword [esi + 0x7c]
jl 0x48a236
jmp 0x48a206
call fcn.004a2daf
int3
Function at 0x4968b6
Capabilities:
Encode data using xor

Disassembly:
cmpsd dword [esi], dword es:[edi]
out dx, eax
lahf
mov esp, 0xfcbe4da1
mov edx, 0xafdda8bc
fcomp dword [edi + 0x3e]
fsin
cmp dword [ebx - 0xc], ecx
jnp 0x4968cf
retf
xchg edi, eax
push dword [ecx + 0x64d6a59d]
add byte [esi - 0x75], 0x92
popfd
movsd dword es:[edi], dword [esi]
salc
add byte fs:[esi - 0x75], 0x92
inc ebx
xor dword [edx], ebx
invalid
stosd dword es:[edi], eax
jge 0x4968f8
cmp al, 0xb4
popal
mov word [ebx - 0x369311de], cs
idiv eax
std
scasb al, byte es:[edi]
loopne 0x49687d
outsb dx, byte [esi]
inc esi
das
push cs
and byte [ebp + edi*4 - 0x77], bl
mov bl, 0x91
cld
or dword [eax + 0x627430ed], 0xb464f514
mov ah, 0x81
mov byte [edi - 8], dh
push 0x5d
lds ecx, [ebx]
jns 0x496852
mov ah, 0x81
mov byte [edi - 8], dh
push 0x5d
lds ecx, [ebx]
jns 0x496852
or byte [ebx], al
dec edi
xor al, 0x3c
and edi, edx
scasd eax, dword es:[edi]
stosb byte es:[edi], al
pop ebp
loop 0x49688f
lodsb al, byte [esi]
clc
mov dh, 0x38
xor dword [edx], ebx
xchg edx, eax
pushfd
xor al, 0x85
popfd
into
salc
nop
jecxz 0x4968d9
inc ebp
insb byte es:[edi], dx
jle 0x49687a
and al, 0xb3
in eax, dx
jnp 0x49695b
invalid
cdq
mov esi, 0xfbdffe00
push 0x86144204
salc
xchg esp, eax
and eax, 0xe4d3fa69
fnstcw word [ecx]
adc al, 0x47
jae 0x49694a
fsub st(7)
test al, 0xcb
mov ebp, 0xe45e7ae4
dec ebp
jge 0x496975
retf
cmpsb byte [esi], byte es:[edi]
invalid
sti
jge 0x4968ca
jo 0x496920
mov dword [0xc115fce8], eax
wait
scasb al, byte es:[edi]
hlt
cld
adc eax, 0xf4ae9bc1
xchg byte [ecx + 0x16f970be], bh
enter 0xffffffffffff8b38, 0xffffffffffffffcf
add bh, byte cs:[ecx + 0x41064bfb]
add bh, byte [ecx + 0x41064bfb]
jno 0x4968eb
cmp bh, dh
into
jecxz 0x496943
push ecx
imul dword [edi]
jle 0x4969af
fist dword [edi]
stosd dword es:[edi], eax
dec ebp
push 0xf22d448a
in eax, dx
in eax, dx
dec esi
insb byte es:[edi], dx
push edx
xor esp, esi
mov eax, dword [0xed458ce5]
xor edi, dword [ebx + 0x4a]
fisubr dword [eax]
xchg esp, eax
cmp ebp, dword [edi - 0xbe4b315]
sbb byte [edx], dl
adc dword [edx - 0x46], esi
stosd dword es:[edi], eax
xchg esp, eax
sub dword [ebx + 0x3b], ebx
iretd
std
inc esi
push esp
push edx
cmpsb byte [esi], byte es:[edi]
xchg ebx, eax
mov byte [0x4dfb9c38], al
iretd
Function at 0x4a0e56
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x38
mov eax, dword [0x581a60]
xor eax, esp
mov dword [esp + 0x34], eax
mov ecx, dword [esi + 0x20]
push ebx
push edi
lea eax, [esp + 0x2c]
xor edi, edi
push eax
push ecx
mov dword [esp + 0x34], edi
mov dword [esp + 0x38], edi
mov dword [esp + 0x3c], edi
mov dword [esp + 0x40], edi
call dword [0x536724]
fld qword [esi + 0x88]
mov eax, dword [esp + 0x34]
fmul qword [0x560e70]
mov ebx, dword [esp + 0x38]
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x30]
mov dword [esp + 0x28], ebx
mov dword [esp + 0x18], ebx
lea ebx, [eax - 0x50]
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x14], eax
mov dword [esp + 0x20], edx
mov dword [esp + 0x24], eax
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x1c], ebx
call fcn.005b3726
mov dword [esp + 0x28], eax
mov dword [esp + 0x18], eax
cmp dword [esi + 0x7c], edi
jg 0x4a0f1e
mov eax, dword [esi + 0x7c]
lea edx, [eax + eax*4]
add edx, edx
add edx, edx
mov dword [esp + 8], edx
fild dword [esp + 8]
fmul qword [esi + 0x88]
call fcn.005b3726
mov ecx, dword [esp + 0x3c]
pop edi
pop ebx
xor ecx, esp
call fcn.005ad401
mov esp, ebp
pop ebp
ret
mov eax, dword [esp + 0x18]
mov ebx, dword [esp + 0x14]
test edi, edi
js 0x4a0fc4
cmp edi, dword [esi + 0x7c]
jge 0x4a0fc4
mov edx, dword [esi + 0x78]
mov ecx, dword [edx + edi*4]
mov edx, dword [esp + 0x10]
push 1
sub eax, edx
push eax
mov eax, dword [esp + 0x14]
sub ebx, eax
push ebx
push edx
mov dword [esp + 0x18], ecx
push eax
add ecx, 0x138
call fcn.004b5868
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x24]
push 1
sub ecx, eax
push ecx
mov ecx, dword [esp + 0x24]
sub edx, ecx
push edx
push eax
push ecx
mov ecx, dword [esp + 0x1c]
call fcn.004b5868
fld qword [esi + 0x88]
fmul qword [0x560e70]
call fcn.005b3726
mov ebx, dword [0x536728]
push eax
push 0
lea eax, [esp + 0x14]
push eax
call ebx
fld qword [esi + 0x88]
fmul qword [0x560e70]
call fcn.005b3726
push eax
push 0
lea ecx, [esp + 0x24]
push ecx
call ebx
inc edi
cmp edi, dword [esi + 0x7c]
jl 0x4a0f16
jmp 0x4a0ee6
call fcn.004b9a8f
int3

Function at 0x4b7901
Capabilities:
Terminate process

Disassembly:
add edi, edi
je 0x4b7929
or al, 0xe8
add al, 0
add byte [eax], al
add esp, 0xc
ret
add byte [eax - 1], dl
adc eax, sym.imp.KERNEL32.dll_TerminateProcess
aam 0xd1
dec ebx
invalid
cmp dword [esp + 0xc], 0
Function at 0x4b792d
Capabilities:
Terminate process

Disassembly:
aam 0xd1
dec ebx
add byte [ebx + 0xc247c], al
push ebx
mov ebx, dword [esp + 0x14]
mov dword [0x4c4d40], edi
mov byte [0x4c4d3c], bl
jne 0x4b7985
mov eax, dword [0x4c53d0]
test eax, eax
je 0x4b7974
mov ecx, dword [0x4c53cc]
push esi
lea esi, [ecx - 4]
cmp esi, eax
jb 0x4b7973
mov eax, dword [esi]
test eax, eax
je 0x4b7968
call eax
sub esi, 4
cmp esi, dword [0x4c53d0]
jae 0x4b7960
pop esi
push 0x4c0018
push 0x4c0014
call fcn.004b79c6
pop ecx
pop ecx
push 0x4c0020
push 0x4c001c
call fcn.004b79c6
pop ecx
pop ecx
test ebx, ebx
pop ebx
je 0x4b79a2
call fcn.004b79bd
pop edi
ret
push dword [esp + 8]
mov dword [0x4c4d44], edi
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x4b847d
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x4c0370
cmp edx, dword [eax]
je 0x4b849f
add eax, 8
inc ecx
cmp eax, 0x4c0400
jl 0x4b8490
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x4c0370]
jne 0x4b85cd
mov eax, dword [0x4c4d00]
cmp eax, 1
je 0x4b85a7
test eax, eax
jne 0x4b84d0
cmp dword [0x4c029c], 1
je 0x4b85a7
cmp edx, 0xfc
je 0x4b85cd
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4b8507
lea eax, [ebp - 0x1a4]
push 0x4bd8d8
push eax
call fcn.004b8e60
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.004b92f0
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x4b854a
lea eax, [ebp - 0x1a4]
push eax
call fcn.004b92f0
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x4bd8d4
push edi
call fcn.004bb1c0
add esp, 0x10
lea eax, [ebp - 0xa0]
push 0x4bd8b8
push eax
call fcn.004b8e60
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.004b8e70
lea eax, [ebp - 0xa0]
push 0x4bd8b4
push eax
call fcn.004b8e70
push dword [esi + 0x4c0374]
lea eax, [ebp - 0xa0]
push eax
call fcn.004b8e70
push 0x12010
lea eax, [ebp - 0xa0]
push 0x4bd88c
push eax
call fcn.004bb134
add esp, 0x2c
pop edi
jmp 0x4b85cd
lea eax, [ebp + 8]
lea esi, [esi + 0x4c0374]
push 0
push eax
push dword [esi]
call fcn.004b92f0
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x4282a0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x17000]
push edi
jmp 0x4282ba
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x4282c1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4282b0
mov eax, 1
add ebx, ebx
jne 0x4282d3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x4282c8
jne 0x4282e4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4282c8
xor ecx, ecx
sub eax, 3
jb 0x4282f8
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x42836a
mov ebp, eax
add ebx, ebx
jne 0x428303
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x428310
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x428334
inc ecx
add ebx, ebx
jne 0x428320
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x428315
jne 0x428331
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x428315
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x428354
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x428345
jmp 0x4282b6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x428354
add edi, ecx
jmp 0x4282b6
pop esi
mov edi, esi
mov ecx, 0x115
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x428372
cmp byte [edi], 3
jne 0x428372
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x428377
lea edi, [esi + 0x26000]
mov eax, dword [edi]
or eax, eax
je 0x4283e6
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x28000]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x280c4]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x4283a4
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x280cc]
or eax, eax
je 0x4283e0
mov dword [ebx], eax
add ebx, 4
jmp 0x4283c1
call dword [esi + 0x280c8]
mov ebp, dword [esi + 0x280d0]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1ef]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x42841a
sub esp, 0xffffff80
jmp 0x409ac0

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43300c
nop
nop
nop
pop eax
nop
nop
nop
add eax, 0x40a063
sub eax, 0x40a009
nop
nop
nop
nop
nop
mov ebx, dword [eax]
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
jl 0x433030
nop
nop
nop
nop
add eax, 0xc
cmp dword [eax], 0
nop
nop
nop
nop
nop
jne 0x43301e
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x431219