joyce8/EMBER2024-capa huggingface dataset:
Function at 0x797ca1
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov ecx, dword [0x6a9ec0]
mov ecx, dword [ecx + 0x768]
mov ecx, dword [ecx + 0x160]
mov eax, 0
push 9
push 0xe
call fcn.0042a0f0
mov ecx, dword [0x6a9ec0]
mov ecx, dword [ecx + 0x768]
mov ecx, dword [ecx + 0x160]
mov eax, 1
push 9
push 0xe
call fcn.0042a0f0
mov ecx, dword [0x6a9ec0]
mov ecx, dword [ecx + 0x768]
mov ecx, dword [ecx + 0x160]
mov eax, 2
push 9
push 0xe
call fcn.0042a0f0
mov ecx, dword [0x6a9ec0]
mov ecx, dword [ecx + 0x768]
mov ecx, dword [ecx + 0x160]
mov eax, 3
push 9
push 0xe
call fcn.0042a0f0
mov ecx, dword [0x6a9ec0]
mov ecx, dword [ecx + 0x768]
mov ecx, dword [ecx + 0x160]
mov eax, 4
push 9
push 0xe
call fcn.0042a0f0
mov ecx, dword [0x6a9ec0]
mov ecx, dword [ecx + 0x768]
mov ecx, dword [ecx + 0x160]
mov eax, 5
push 9
push 0xe
call fcn.0042a0f0
popal
ret

Function at 0x79b7ca
Capabilities:
Packed with generic packer

Disassembly:
mov eax, dword [ebx + 0x320]
cmp ecx, 0x70
jl 0x79b7f5
cmp ecx, 0x7b
ja 0x79b7f5
pushal
push 0
push 0x69904b
push 0x79b7f8
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
popal
jmp fcn.0065148a
ret
Function at 0x402310
Capabilities:
Check os version

Disassembly:
sub esp, 0x94
lea eax, [esp]
push esi
push eax
xor esi, esi
mov dword [esp + 8], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x402345
cmp dword [esp + 0x14], 2
jne 0x402345
mov eax, dword [esp + 8]
cmp eax, 6
mov eax, 1
jae 0x402347
mov eax, esi
pop esi
add esp, 0x94
ret

Function at 0x402a20
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x407ff8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
push edi
mov edi, ecx
lea ecx, [esp + 8]
call sub.MFC42.DLL_CString::CString
push 0x104
push 0x104
lea ecx, [esp + 0x10]
mov dword [esp + 0x1c], 0
call sub.MFC42.DLL_CString::GetBuffer
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push 0xffffffffffffffff
lea ecx, [esp + 0xc]
call sub.MFC42.DLL_CString::ReleaseBuffer
push str.winhlp32.exe
lea ecx, [esp + 0xc]
call fcn.004079c8
mov eax, dword [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
test esi, esi
je 0x402aa6
push 0x6a
push esi
call dword [sym.imp.USER32.dll_LoadCursorA]
test eax, eax
je 0x402aa6
push eax
call dword [sym.imp.USER32.dll_CopyIcon]
mov dword [edi + 0x44], eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea ecx, [esp + 8]
mov dword [esp + 0x14], 0xffffffff
call fcn.00407896
mov ecx, dword [esp + 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x402d90
Capabilities:
Send data
Send data on socket

Disassembly:
mov eax, dword [0x40c14c]
push esi
mov word [0x40c674], ax
inc eax
mov dword [0x40c14c], eax
mov eax, dword [0x40c150]
mov word [0x40c676], ax
inc eax
push edi
mov dword [0x40c150], eax
mov edi, ecx
mov byte [0x40c670], 8
mov byte [0x40c671], 0
mov word [0x40c672], 0
xor eax, eax
mov cl, al
add cl, 0x20
mov byte [eax + 0x40c67d], cl
inc eax
cmp eax, 0x20
jl 0x402dcf
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push 0x2d
push 0x40c670
mov ecx, edi
mov dword [0x40c679], eax
call fcn.00402fb0
mov edx, dword [esp + 0x10]
push 0x10
push edx
mov word [0x40c672], ax
mov eax, dword [esp + 0x14]
push 0
push 0x2d
push 0x40c670
push eax
call dword [sym.imp.WSOCK32.dll_sendto]
mov esi, eax
cmp esi, 0xffffffff
jne 0x402e2d
push str.sendto__
mov ecx, edi
call fcn.00402f10
mov eax, esi
pop edi
pop esi
ret 8

Function at 0x402e40
Capabilities:
Receive data
Receive data on socket

Disassembly:
sub esp, 0x148
push esi
mov esi, ecx
mov ecx, dword [esp + 0x154]
lea eax, [esp + 4]
push eax
mov eax, dword [esp + 0x154]
push ecx
push 0
lea edx, [esp + 0x14]
push 0x141
push edx
push eax
mov dword [esp + 0x1c], 0x10
call dword [sym.imp.WSOCK32.dll_recvfrom]
cmp eax, 0xffffffff
jne 0x402ea4
push str.recvfrom__
mov ecx, esi
call fcn.00402f10
mov ecx, dword [esp + 0x158]
mov dl, byte [esp + 0x10]
mov eax, dword [esp + 0x25]
pop esi
mov byte [ecx], dl
add esp, 0x148
ret 0xc
mov eax, dword [esp + 0x158]
mov cl, byte [esp + 0x10]
pop esi
mov byte [eax], cl
mov eax, dword [esp + 0x21]
add esp, 0x148
ret 0xc

Function at 0x402ec0
Capabilities:
Get socket status

Disassembly:
sub esp, 0x10c
mov ecx, dword [esp + 0x110]
lea edx, [esp]
mov dword [esp + 0xc], ecx
push edx
push 0
lea ecx, [esp + 0x10]
mov eax, 1
push 0
push ecx
push eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], 0
call dword [sym.imp.WSOCK32.dll_select]
add esp, 0x10c
ret 4

Function at 0x4034c1
Capabilities:
Create thread

Disassembly:
push ebx
push esi
mov esi, ecx
push edi
lea ecx, [esi + 0x18]
call sub.MFC42.DLL_CString::CString
mov ebx, dword [sym.imp.KERNEL32.dll_CreateEventA]
push 0
lea edi, [esi + 4]
push 0
push 1
push 0
mov dword [esi], 0x409ce4
mov dword [edi], 0
mov dword [esi + 8], 0
call ebx
push 0
push 0
push 0
push 0
mov dword [esi + 0xc], eax
call ebx
push edi
push 0
push esi
push 0x403580
push 0
push 0
mov dword [esi + 0x10], eax
call dword [sym.imp.MSVCRT.dll__beginthreadex]
add esp, 0x18
mov dword [esi + 8], eax
mov eax, esi
pop edi
pop esi
pop ebx
ret
Function at 0x403ce0
Capabilities:
Create http request

Disassembly:
push 0xffffffffffffffff
push 0x4081f0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
push ebp
push esi
push edi
xor ebp, ebp
push 0x4000000
push ebp
push ebp
push ebp
push 1
push ebp
lea ecx, [esp + 0x30]
mov dword [esp + 0x4c], ebp
mov dword [esp + 0x2c], ebp
call sub.MFC42.DLL_CInternetSession::CInternetSession
push ebp
push ebp
push ebp
push ebp
push ebp
mov byte [esp + 0x48], 1
call dword [sym.imp.WININET.dll_InternetOpenA]
push ebp
mov edi, eax
mov eax, dword [esp + 0x40]
push 2
push ebp
push ebp
push eax
push edi
call dword [sym.imp.WININET.dll_InternetOpenUrlA]
mov esi, eax
cmp esi, ebp
jne 0x403d77
lea ecx, [esp + 0x18]
mov byte [esp + 0x34], 0
call fcn.00407a8e
lea ecx, [esp + 0x3c]
mov dword [esp + 0x34], 0xffffffff
call fcn.00407896
pop edi
pop esi
xor eax, eax
pop ebp
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
add esp, 0x2c
ret 8
cmp edi, ebp
mov ebp, dword [sym.imp.WININET.dll_InternetCloseHandle]
je 0x403d84
push edi
call ebp
push esi
call ebp
mov ecx, dword [esp + 0x3c]
push 0
push 0
push 1
push 1
push ecx
lea ecx, [esp + 0x2c]
call sub.MFC42.DLL_CInternetSession::OpenURL
push 0x40c66c
lea ecx, [esp + 0x14]
mov esi, eax
call sub.MFC42.DLL_CString::CString_2
push 0x40c66c
lea ecx, [esp + 0x10]
mov byte [esp + 0x38], 2
call sub.MFC42.DLL_CString::CString_2
mov edx, dword [esi]
lea eax, [esp + 0x10]
push eax
mov ecx, esi
mov byte [esp + 0x38], 3
call dword [edx + 0x60]
test eax, eax
jle 0x403e0b
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
push 0x40c23c
lea ecx, [esp + 0x10]
call fcn.004079c8
lea ecx, [esp + 0x10]
push ecx
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::operator_1
push 1
call edi
mov edx, dword [esi]
lea eax, [esp + 0x10]
push eax
mov ecx, esi
call dword [edx + 0x60]
test eax, eax
jg 0x403ddb
mov edx, dword [esp + 0xc]
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x403e56
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ebp, dword [edx - 8]
not ecx
dec ecx
inc ebp
push ecx
push ebp
lea ecx, [esp + 0x14]
call sub.MFC42.DLL_CString::GetBuffer
mov ecx, dword [esp + 0x44]
push eax
push ecx
call fcn.00403bf0
add esp, 0xc
lea ecx, [esp + 0xc]
push 0xffffffffffffffff
call sub.MFC42.DLL_CString::ReleaseBuffer
mov edi, 1
jmp 0x403e5a
mov edi, dword [esp + 0x14]
mov edx, dword [esi]
mov ecx, esi
call dword [edx + 0x54]
test esi, esi
je 0x403e6e
mov eax, dword [esi]
push 1
mov ecx, esi
call dword [eax + 4]
lea ecx, [esp + 0x18]
call sub.MFC42.DLL_CInternetSession::Close
lea ecx, [esp + 0xc]
mov byte [esp + 0x34], 2
call fcn.00407896
lea ecx, [esp + 0x10]
mov byte [esp + 0x34], 1
call fcn.00407896
lea ecx, [esp + 0x18]
mov byte [esp + 0x34], 0
call fcn.00407a8e
lea ecx, [esp + 0x3c]
mov dword [esp + 0x34], 0xffffffff
call fcn.00407896
mov ecx, dword [esp + 0x2c]
mov eax, edi
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x2c
ret 8
Function at 0x15ace058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.15ace1a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, pe_nt_image_headers32
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x15ace07e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x15ace06a
add dl, dl
jne 0x15ace089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x15ace0dc
xor eax, eax
add dl, dl
jne 0x15ace096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x15ace17d
add dl, dl
jne 0x15ace0a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x15ace0b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x15ace0bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x15ace0c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x15ace0d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x15ace075
mov eax, 1
add dl, dl
jne 0x15ace0ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x15ace0f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x15ace0e1
sub eax, ebx
mov ebx, 1
jne 0x15ace128
mov ecx, 1
add dl, dl
jne 0x15ace10e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x15ace119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x15ace105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x15ace075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x15ace13f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x15ace14a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x15ace136
cmp eax, 0x7d00
jae 0x15ace16d
cmp eax, 0x500
jb 0x15ace168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x15ace075
cmp eax, 0x7f
ja 0x15ace170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x15ace075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x15ace19e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x15ace075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0xe543b0
Capabilities:
Encode data using xor

Disassembly:
jmp 0xe543ba
pushal
call 0xe543c0
pop ebp
sub ebp, 0x10
sub ebp, 0xa543b0
jmp 0xe543d6
in eax, dx
mov al, 0x43
inc ebx
movsd dword es:[edi], dword [esi]
add cl, ch
add al, 0
add byte [eax], al
jg 0xe543c8
sar dword [ecx - 0x5abc4f48], 1
add byte [ebx], al
lds eax, [ecx + 0x4cc0]
add byte [ecx + 0x604], bh
mov eax, 0xa543b0
add eax, ebp
add eax, 0x4c
mov ecx, 0x604
mov edx, 0x723d6485
xor byte [eax], dl
inc eax
dec ecx
jne 0xe543ed
jmp 0xe54400
push cs
dec eax
push cs
or al, 0xb9
test dword [ebp + 0x7d440485], eax
test dword [ebp + 0x3d488685], eax
xchg esp, eax
test dword [ebp - 0x7a52c07b], eax
test dword [ebp + 0x4d866772], eax
push cs
add al, 0x89
test dword [ebp + 0x8408685], eax
loope 0xe543ca
jns 0xe54437
and dword [ecx + 0x79a1e108], 0xeda1810c
test dword [0x35ed858b], eax
add eax, 0x35ed858b
mov eax, dword [ebp + 0x134635ed]
test dword [ecx + ebp*4 + 0x1ef5eda1], eax
inc esi
adc eax, dword [ebp - 0x125e567c]
cmc
push ds
adc byte [0x8585806d], ah
test dword [ebx + ebp*4 - 0x7b], ebp
test dword [ebp + 0x79a1e108], eax
or al, 0xa9
mov eax, dword [0xe690e]
lea eax, [ebp + 0x100e8585]
mov dword [ebp + 0x80e8585], eax
xchg ebp, eax
test dword [ebp - 0x7893bb7b], eax
mov ah, 0x87
push es
inc edi
or esp, 0x7a71008a
jp 0xe544f4
fadd dword [edi - 0x77]
test dword [esi], ecx
or dword [ecx - 0x7a7a7a7f], esp
in eax, dx
test dword [0x35ed858b], eax
inc esi
adc eax, dword [ebp + 0x8a1a984]
loope 0xe54436
jns 0xe544a3
mov dword [ecx - 0x7a7a7f93], esp
test dword [esp + edx*8 - 0x79], ebp
insb byte es:[edi], dx
aam 0x87
test dword [ebp + 0x79a1e108], eax
or al, 0xa9
mov eax, dword [0xf07ad8d1]
or cl, ah
mov eax, dword [0xa1a90c79]
rcr eax, 1
jp 0xe5449e
mov dword [edx - 0x10], edi
lea ebp, [ebp - 5]
test dword [ebp - 0x72c7f17b], eax
test dword [ebp + 0x23740485], eax
retf 0x59dc
test dword [ebp - 0x759381fb], eax
add dword [ebp + eax*4 + 0x4e38585], edx
jle 0xe5457d
mov al, byte [0x8590018a]
test dword [ebp + 0x7a496cc4], eax
les ebp, [ecx + ecx*2 + 0x7a]
jp 0xe5458a
lodsb al, byte [esi]
leave
mov esp, 0x80440684
push es
insd dword es:[edi], dx
sub dword [eax + edi + 0x7a], 0xd1ac7a7a
mov esp, 0x83440687
push es
outsd dx, dword [esi]
add dword [esi], 0x2e6c806d
jp 0xe545aa
jp 0xe5450a
inc edi
mov dword [ebp - 0x2c96f130], eax
rcl al, cl
push cs
invalid
test dword [ebp + 0x578745b6], eax
mov al, byte [eax]
add byte [ebp - 0x6cf07a7b], 0xc3
xchg edi, eax
push edi
mov al, byte [esi]
scasd eax, dword es:[edi]
test byte [ebp - 0x75a8787b], al
add byte [eax + 0xf858585], al
xchg ebx, eax
ret
xchg ebx, eax
ret
test dword [edi], ecx
xchg ebx, eax
ret
Function at 0x431000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x40915c
nop
mov ecx, 0x2c0c19da
nop
nop
test eax, eax
nop
nop
nop
je 0x43104e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x431024
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x42f3f8
nop
mov ecx, 0x7bfc6be5
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x431084
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x43106c
nop
nop
nop
nop
nop
popal
nop
jmp 0x401219
Function at 0x40595e
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
pushal
call 0x40596d
pop dword [ebp - 0x48]
mov eax, 0x40596d
sub dword [ebp - 0x48], eax
mov dword [ebp - 0x58], 0xbc6d5e97
sub dword [ebp - 0x58], 0x6e1b194c
mov dword [ebp - 0x54], 0x7078d057
sub dword [ebp - 0x54], 0x3e458412
mov dword [ebp - 0x50], 0x5033e648
add dword [ebp - 0x50], 0xfc185de6
mov dword [ebp - 0x4c], 0x98884e6e
sub dword [ebp - 0x4c], 0x98884e6e
lea eax, [ebp - 0x58]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x48]
call dword [eax]
mov dword [ebp - 0x58], 0xe9f6af85
sub dword [ebp - 0x58], 0x7584462f
mov dword [ebp - 0x54], 0xb2dd3a42
sub dword [ebp - 0x54], 0x7170d8cd
mov dword [ebp - 0x50], 0x3f0afca4
sub dword [ebp - 0x50], 0xdb9b9038
mov dword [ebp - 0x4c], 0x86ac2641
add dword [ebp - 0x4c], 0x7953d9bf
lea ebx, [ebp - 0x58]
push ebx
push eax
mov eax, 0xf190b1ba
sub eax, 0xf15040ba
add eax, dword [ebp - 0x48]
call dword [eax]
push 0x40
push 0x1000
push 0x39aff
push 0
call eax
mov ecx, 0xe21dc3af
add ecx, 0x1de29033
xor edx, edx
add edx, eax
mov ebx, 0x410000
add ebx, dword [ebp - 0x48]
mov esi, 0xd652bb3
sub dword [ebp - 0x38], 0x17966bc6
mov edi, dword [ebx]
sub dword [ebp - 8], edi
xor edi, esi
add dword [ebp - 4], 0xf28020af
mov dword [edx], edi
xor dword [ebp - 0x34], esi
add edx, 0x7c0a8d56
add edx, 0x83f572ae
add ebx, 0x935a96d4
sub ebx, 0x935a96d0
loop 0x405a7b
add eax, 0x1425b
mov ebx, eax
add eax, 5
mov ecx, 0xc3a4fb81
sub ecx, 0xc364fb81
add ecx, dword [ebp - 0x48]
call ebx
leave
ret

Function at 0x4065b0
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x40c17c]
jne 0x4065ba
repz ret
jmp fcn.00406941
Function at 0x10002fa6
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
pushal
call 0x10002fb5
pop dword [ebp - 0x18]
mov eax, 0x10002fb5
sub dword [ebp - 0x18], eax
mov dword [ebp - 0x28], 0xb580bab1
add dword [ebp - 0x28], 0x98d18a9a
mov dword [ebp - 0x24], 0x83ad64e
add dword [ebp - 0x24], 0x29f875f7
mov dword [ebp - 0x20], 0x8264d3e2
sub dword [ebp - 0x20], 0x36188fb4
mov dword [ebp - 0x1c], 0x646d4da1
sub dword [ebp - 0x1c], 0x646d4da1
lea eax, [ebp - 0x28]
push eax
mov eax, 0x63ce4b04
add eax, 0xac324554
add eax, dword [ebp - 0x18]
call dword [eax]
mov dword [ebp - 0x28], 0xf39810db
add dword [ebp - 0x28], 0x80da587b
mov dword [ebp - 0x24], 0x620a8ad4
sub dword [ebp - 0x24], 0x209e295f
mov dword [ebp - 0x20], 0xc1ae73b9
sub dword [ebp - 0x20], 0x5e3f074d
mov dword [ebp - 0x1c], 0x8b8ceb34
add dword [ebp - 0x1c], 0x747314cc
lea ebx, [ebp - 0x28]
push ebx
push eax
mov eax, 0xee92b7ef
sub eax, 0xde9227ef
add eax, dword [ebp - 0x18]
call dword [eax]
push 0x40
push 0x1000
push 0x36e78
push 0
call eax
mov ecx, 0xe42a7b5f
add ecx, 0x1bd5cba0
xor esi, esi
add esi, eax
mov edi, 0x9b023be7
add edi, 0x74feac19
add edi, dword [ebp - 0x18]
mov edx, 0x33697791
mov dword [ebp - 0x10], 0xc1b2d46e
mov ebx, dword [edi]
xor dword [ebp - 0x14], eax
xor ebx, edx
mov dword [esi], ebx
xor dword [ebp - 0x14], edi
add esi, 0x92b77e9e
add esi, 0x6d488166
add edi, 4
loop 0x100030ce
add eax, 0xa9346bd0
add eax, 0x56cca2ff
xor ebx, ebx
add ebx, eax
add eax, 0x35a36e7e
sub eax, 0x35a36e79
mov ecx, 0xd87a2b3f
add ecx, 0x3785d4c1
add ecx, dword [ebp - 0x18]
call ebx
leave
ret

Function at 0x100082ac
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [section..data]
jne 0x100082b6
repz ret
jmp fcn.1000869f
Function at 0x1814ac0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x132e000]
push edi
or ebp, 0xffffffff
jmp 0x1814ae2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x1814ae9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x1814ad8
mov eax, 1
add ebx, ebx
jne 0x1814afb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x1814b0c
jne 0x1814b2b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x1814b2b
dec eax
add ebx, ebx
jne 0x1814b18
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x1814af0
add ebx, ebx
jne 0x1814b27
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x1814b7d
xor ecx, ecx
sub eax, 3
jb 0x1814b43
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x1814bb2
sar eax, 1
mov ebp, eax
jmp 0x1814b4e
add ebx, ebx
jne 0x1814b4e
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x1814b1c
inc ecx
add ebx, ebx
jne 0x1814b5c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x1814b1c
add ebx, ebx
jne 0x1814b69
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x1814b5e
jne 0x1814b7a
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x1814b5e
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x1814b9c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x1814b8e
jmp 0x1814ade
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x1814b9c
add edi, ecx
jmp 0x1814ade
pop esi
mov edi, esi
mov ecx, 0xd3d8
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x1814bba
cmp byte [edi], 0x3e
jne 0x1814bba
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x1814bbf
lea edi, [esi + 0x1410000]
mov eax, dword [edi]
or eax, eax
je 0x1814c2e
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x247fa78]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x247fba8]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x1814bec
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x247fbb0]
or eax, eax
je 0x1814c28
mov dword [ebx], eax
add ebx, 4
jmp 0x1814c09
call dword [esi + 0x247fbac]
mov ebp, dword [esi + 0x247fbb4]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x21f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x1814c62
sub esp, 0xffffff80
jmp 0x6bffa0
Function at 0x1061e058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x1061e1a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, pe_nt_image_headers32
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x1061e07e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x1061e06a
add dl, dl
jne 0x1061e089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x1061e0dc
xor eax, eax
add dl, dl
jne 0x1061e096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x1061e17d
add dl, dl
jne 0x1061e0a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1061e0b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1061e0bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1061e0c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x1061e0d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x1061e075
mov eax, 1
add dl, dl
jne 0x1061e0ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1061e0f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x1061e0e1
sub eax, ebx
mov ebx, 1
jne 0x1061e128
mov ecx, 1
add dl, dl
jne 0x1061e10e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1061e119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x1061e105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x1061e075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x1061e13f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1061e14a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x1061e136
cmp eax, 0x7d00
jae 0x1061e16d
cmp eax, 0x500
jb 0x1061e168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x1061e075
cmp eax, 0x7f
ja 0x1061e170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x1061e075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x1061e19e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x1061e075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10