joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1001a9b0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28c
mov eax, dword [0x10021008]
xor eax, ebp
mov dword [ebp - 8], eax
push esi
push edi
push 0x58
lea eax, [ebp - 0x28c]
mov edi, edx
push 0
push eax
mov esi, ecx
call sub.VCRUNTIME140.dll_memset
mov eax, dword [esi]
add esp, 0xc
mov dword [ebp - 0x288], eax
lea eax, [ebp - 0x11c]
mov dword [ebp - 0x28c], 0x58
push 0x100
push 0
push eax
call sub.VCRUNTIME140.dll_memset
xor eax, eax
mov byte [ebp - 0x1c], 0
add esp, 0xc
mov word [ebp - 0x22c], ax
mov dword [ebp - 0x222], eax
xorps xmm0, xmm0
mov word [ebp - 0x21e], ax
lea eax, [ebp - 0x22c]
movups xmmword [ebp - 0x1b], xmm0
push eax
mov word [ebp - 0xb], 0
mov byte [ebp - 9], 0
movq qword [ebp - 0x22a], xmm0
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx eax, word [ebp - 0x220]
push eax
movzx eax, word [ebp - 0x222]
push eax
movzx eax, word [ebp - 0x224]
push eax
movzx eax, word [ebp - 0x226]
push eax
movzx eax, word [ebp - 0x22a]
push eax
movzx eax, word [ebp - 0x22c]
push eax
lea eax, [ebp - 0x1c]
push str._04d_02d_02d__02d_02d_02d
push eax
call fcn.1001acb0
lea eax, [esi + 0x218]
push eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [esi + 8]
push eax
lea eax, [ebp - 0x11c]
push str.CG70__s__s._s.bin
push eax
call fcn.1001acf0
add esp, 0x34
lea eax, [ebp - 0x21c]
push 0x100
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0x11c]
push eax
lea eax, [esi + 0x118]
push eax
lea eax, [ebp - 0x21c]
push str._s_s
push eax
call fcn.1001acf0
lea eax, [ebp - 0x11c]
mov dword [ebp - 0x26c], 0x100
mov dword [ebp - 0x270], eax
add esp, 0x10
lea eax, [esi + 0x318]
mov dword [ebp - 0x280], eax
lea eax, [ebp - 0x28c]
push eax
call dword [sym.imp.COMDLG32.dll_GetSaveFileNameA]
test eax, eax
je 0x1001ab66
lea eax, [ebp - 0x11c]
add esi, 0x418
push eax
push 0x100
push esi
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strcpy_s]
add esp, 0xc
mov dword [ebp - 0x230], 0
lea eax, [ebp - 0x230]
push 0x1001f370
push esi
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen_s]
mov eax, dword [ebp - 0x230]
add esp, 0xc
test eax, eax
jne 0x1001ab96
pop edi
pop esi
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.1001d9a3
mov esp, ebp
pop ebp
ret
push 0x1001f370
lea eax, [ebp - 0x21c]
mov dword [ebp - 0x230], 0
push eax
lea eax, [ebp - 0x230]
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen_s]
mov eax, dword [ebp - 0x230]
add esp, 0xc
test eax, eax
je 0x1001abb2
push eax
push dword [ebp + 8]
push 1
push edi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
push dword [ebp - 0x230]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 0x14
mov ecx, dword [ebp - 8]
mov eax, 1
pop edi
xor ecx, ebp
pop esi
call fcn.1001d9a3
mov esp, ebp
pop ebp
ret
Function at 0x1001abd0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x10021008]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x100
lea eax, [ebp - 0x104]
mov esi, ecx
push 0
push eax
call sub.VCRUNTIME140.dll_memset
lea eax, [esi + 0x18]
push eax
lea eax, [ebp - 0x104]
push str._s_btn.ini
push eax
call fcn.1001acf0
push 0x1001f380
lea eax, [ebp - 0x104]
mov dword [ebp - 0x108], 0
push eax
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen_s]
add esp, 0x24
cmp dword [ebp - 0x108], 0
pop esi
je 0x1001ac91
lea eax, [ebp - 0x104]
push eax
push 0xffffffffffffffff
push str.func
push str.Button
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov dword [0x10022c74], eax
cmp eax, 0x64
je 0x1001ac6f
or ecx, 0xffffffff
cmp eax, 0x6f
cmovne eax, ecx
mov dword [0x10022c74], eax
push dword [ebp - 0x108]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 4
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1001d9a3
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
call fcn.1001d9a3
mov esp, ebp
pop ebp
ret
Function at 0x1001c350
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x10021008]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 0x10], 0x4000000
mov ebx, edx
mov dword [ebp - 0x1c], edi
call fcn.1001a8e0
test eax, eax
je 0x1001c546
push 0x1001f1d4
lea eax, [edi + 0x418]
mov dword [ebp - 8], 0
push eax
lea eax, [ebp - 8]
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen_s]
mov eax, dword [ebp - 8]
add esp, 0xc
test eax, eax
je 0x1001c50e
push 2
push 0
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
add esp, 0xc
push dword [ebp - 8]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
add esp, 4
mov esi, eax
push dword [ebp - 8]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_rewind]
add esp, 4
push esi
call fcn.1001d9b4
add esp, 4
mov dword [ebp - 0xc], eax
push dword [ebp - 8]
push esi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
push dword [ebp - 8]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 0x14
mov dword [ebp - 8], 0
cmp dword [edi + 0x6ce], esi
je 0x1001c42d
mov esi, 0x102
mov edi, dword [ebp - 0xc]
test edi, edi
je 0x1001c41a
push edi
call fcn.1001d9bd
add esp, 4
mov eax, esi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1001d9a3
mov esp, ebp
pop ebp
ret
push 0
push 0x1001f3a4
push 2
call ebx
add esp, 0xc
mov dword [ebp - 0x18], 2
mov dword [ebp - 0x14], 0x30
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
sub esp, 0xd0
lea esi, [ebp + 8]
mov edi, esp
lea eax, [ebp - 0x18]
mov ecx, 0x34
mov edx, ebx
rep movsd dword es:[edi], dword [esi]
push eax
lea ecx, [ebp - 0x10]
call fcn.1001bdd0
mov esi, eax
add esp, 0xd4
test esi, esi
jne 0x1001c40a
push 0x3f5
push 0x1001f3a4
push 0xc8
call ebx
add esp, 0xc
push esi
push 0x1001f3a4
push 0x34
call ebx
add esp, 0xc
mov dword [ebp - 0x18], 0x34
mov dword [ebp - 0x14], 0x30
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
mov edx, dword [ebp - 0x1c]
lea eax, [ebp - 0x18]
mov edi, dword [ebp - 0xc]
push eax
push ebx
push ecx
mov ecx, dword [edx + 0x6ae]
add ecx, dword [ebp - 0x10]
mov edx, dword [edx + 0x6ce]
push edi
call fcn.1001ba10
mov esi, eax
add esp, 0x10
test esi, esi
jne 0x1001c40d
push 0x3f5
push str._success
push 0x190
call ebx
add esp, 0xc
push esi
push 0x1001f3a4
push 0x64
call ebx
add esp, 0xc
jmp 0x1001c40d
push 0
push 0x1001f3a4
push 0
call ebx
add esp, 0xc
push 0x403
push str._failed.
push 0x190
call ebx
add esp, 0xc
mov eax, 0x100
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1001d9a3
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov eax, 0x101
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1001d9a3
mov esp, ebp
pop ebp
ret
Function at 0x401af0
Capabilities:
Read file on windows

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 0x114]
push edi
mov edi, dword [esp + 0x10]
add eax, edi
cmp eax, dword [esi + 0x110]
jbe 0x401b21
push 0
push 0x43a6ac
push str.File
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
pop edi
pop esi
ret 8
mov ecx, dword [esi + 4]
mov edx, dword [esp + 0xc]
push ecx
push 1
push edi
push edx
call fcn.0042178d
add dword [esi + 0x114], edi
add esp, 0x10
pop edi
pop esi
ret 8

Function at 0x401e30
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push edi
mov edi, dword [esp + 0x10]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x401e49
pop edi
pop ebx
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x401e84
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [esp + 0x18]
add eax, esi
and ecx, 0xf
jbe 0x401e80
lea ebx, [ebx]
cmp esi, eax
jae 0x401e84
sub ecx, 1
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x401e70
cmp esi, eax
jb 0x401e8a
pop esi
pop edi
xor eax, eax
pop ebx
ret
mov ax, word [esi]
neg ax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebx
ret

Function at 0x4024f0
Capabilities:
Hide graphical window

Disassembly:
sub esp, 0x84
mov eax, dword [0x44b650]
xor eax, esp
mov dword [esp + 0x80], eax
mov eax, dword [esp + 0x88]
test eax, eax
push esi
mov esi, ecx
je 0x402525
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x402515
sub eax, edx
cmp eax, 2
jae 0x40256b
mov eax, dword [0x44cb08]
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 3
lea ecx, [esp + 8]
push str.Update_failed_with_error_code__d_
push ecx
call fcn.004222e6
add esp, 0xc
push 0x10
push str.Silkroad_Online
lea edx, [esp + 0xc]
push edx
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov eax, dword [esi + 0x20]
push 0
push 0
push 0x10
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
mov ecx, dword [esp + 0x84]
pop esi
xor ecx, esp
call fcn.00421b6f
add esp, 0x84
ret 4

Function at 0x402590
Capabilities:
Hide graphical window

Disassembly:
sub esp, 0x84
mov eax, dword [0x44b650]
xor eax, esp
mov dword [esp + 0x80], eax
mov eax, dword [0x44cb08]
push esi
push 0
push eax
mov esi, ecx
call dword [sym.imp.USER32.dll_ShowWindow]
movzx ecx, word [esp + 0x8c]
push ecx
lea edx, [esp + 8]
push str.Update_failed_with_error_code__d_
push edx
call fcn.004222e6
add esp, 0xc
push 0x10
push str.Silkroad_Online
lea eax, [esp + 0xc]
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov ecx, dword [esi + 0x20]
push 0
push 0
push 0x10
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
mov ecx, dword [esp + 0x84]
pop esi
xor ecx, esp
call fcn.00421b6f
add esp, 0x84
ret 4
Function at 0x43674f
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x98
mov eax, dword [0x44b650]
xor eax, ebp
mov dword [ebp + 0x74], eax
push esi
mov esi, ecx
call fcn.004366e4
mov eax, 0x400000
push 0x94
mov dword [esi + 8], eax
mov dword [esi + 4], eax
lea eax, [ebp - 0x20]
push 0
push eax
mov dword [esi], 0x3c
mov byte [esi + 0xc], 0
call fcn.00420fa0
add esp, 0xc
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x20], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x10], 2
jne 0x43679e
cmp dword [ebp - 0x1c], 5
jb 0x4367b6
jmp 0x4367b2
cmp dword [ebp - 0x10], 1
jne 0x4367b6
cmp dword [ebp - 0x1c], 4
ja 0x4367b2
jne 0x4367b6
cmp dword [ebp - 0x18], 0
jbe 0x4367b6
mov byte [esi + 0xc], 1
lea ecx, [esi + 0x18]
mov dword [esi + 0x10], 0x800
mov dword [esi + 0x14], 0x43fcb4
call fcn.004365b8
test eax, eax
jge 0x4367d7
mov byte [0x44cb80], 1
mov ecx, dword [ebp + 0x74]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.00421b6f
add ebp, 0x78
leave
ret

Function at 0x1019058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x10191a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x101907e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x101906a
add dl, dl
jne 0x1019089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x10190dc
xor eax, eax
add dl, dl
jne 0x1019096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x101917d
add dl, dl
jne 0x10190a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x10190b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x10190bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x10190c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x10190d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x1019075
mov eax, 1
add dl, dl
jne 0x10190ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x10190f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x10190e1
sub eax, ebx
mov ebx, 1
jne 0x1019128
mov ecx, 1
add dl, dl
jne 0x101910e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1019119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x1019105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x1019075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x101913f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x101914a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x1019136
cmp eax, 0x7d00
jae 0x101916d
cmp eax, 0x500
jb 0x1019168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x1019075
cmp eax, 0x7f
ja 0x1019170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x1019075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x101919e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x1019075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..retplne
mov ebx, 0x40de38
nop
mov ecx, 0x68130307
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x43304e
nop
nop
nop
nop
xor dword [eax], ecx
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x433024
nop
mov eax, section..reloc
nop
mov ebx, 0x4304d8
nop
nop
mov ecx, 0x4d2d4fb5
test eax, eax
nop
nop
nop
nop
nop
je 0x433084
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x43306c
nop
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0x433004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
call 0x43300c
pop eax
nop
nop
nop
nop
nop
add eax, 0x40a063
nop
nop
sub eax, 0x40a009
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
jl 0x433030
nop
nop
nop
nop
nop
nop
nop
add eax, 0xc
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43301e
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x431219
Function at 0x4aa9c0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x8b000]
push edi
or ebp, 0xffffffff
jmp 0x4aa9e2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x4aa9e9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4aa9d8
mov eax, 1
add ebx, ebx
jne 0x4aa9fb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x4aaa0c
jne 0x4aaa2b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4aaa2b
dec eax
add ebx, ebx
jne 0x4aaa18
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x4aa9f0
add ebx, ebx
jne 0x4aaa27
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x4aaa7d
xor ecx, ecx
sub eax, 3
jb 0x4aaa43
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x4aaab2
sar eax, 1
mov ebp, eax
jmp 0x4aaa4e
add ebx, ebx
jne 0x4aaa4e
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4aaa1c
inc ecx
add ebx, ebx
jne 0x4aaa5c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4aaa1c
add ebx, ebx
jne 0x4aaa69
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x4aaa5e
jne 0x4aaa7a
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4aaa5e
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x4aaa9c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x4aaa8e
jmp 0x4aa9de
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x4aaa9c
add edi, ecx
jmp 0x4aa9de
pop esi
mov edi, esi
mov ecx, 0x65f
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x4aaaba
cmp byte [edi], 9
jne 0x4aaaba
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x4aaabf
lea edi, [esi + 0xa8000]
mov eax, dword [edi]
or eax, eax
je 0x4aab2e
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x10e6f4]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x10e7c0]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x4aaaec
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x10e7c8]
or eax, eax
je 0x4aab28
mov dword [ebx], eax
add ebx, 4
jmp 0x4aab09
call dword [esi + 0x10e7c4]
mov ebp, dword [esi + 0x10e7cc]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x20f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x4aab62
sub esp, 0xffffff80
jmp 0x401ebc
Function at 0x6b7a30
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x1fd000]
mov dword [edi + 0x2014d4], 0x635eccb7
push edi
or ebp, 0xffffffff
jmp 0x6b7a5a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x6b7a61
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x6b7a50
mov eax, 1
add ebx, ebx
jne 0x6b7a73
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x6b7a84
jne 0x6b7aa3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x6b7aa3
dec eax
add ebx, ebx
jne 0x6b7a90
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x6b7a68
add ebx, ebx
jne 0x6b7a9f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x6b7af5
xor ecx, ecx
sub eax, 3
jb 0x6b7abb
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x6b7b2a
sar eax, 1
mov ebp, eax
jmp 0x6b7ac6
add ebx, ebx
jne 0x6b7ac6
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x6b7a94
inc ecx
add ebx, ebx
jne 0x6b7ad4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x6b7a94
add ebx, ebx
jne 0x6b7ae1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x6b7ad6
jne 0x6b7af2
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x6b7ad6
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x6b7b14
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x6b7b06
jmp 0x6b7a56
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x6b7b14
add edi, ecx
jmp 0x6b7a56
pop esi
mov edi, esi
mov ecx, 0x162f3
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x6b7b32
cmp byte [edi], 0x6d
jne 0x6b7b32
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x6b7b37
lea edi, [esi + 0x2b3000]
mov eax, dword [edi]
or eax, eax
je 0x6b7ba6
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x2ba988]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x2baadc]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x6b7b64
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x2baae0]
or eax, eax
je 0x6b7ba0
mov dword [ebx], eax
add ebx, 4
jmp 0x6b7b81
call dword [esi + 0x2baaf0]
mov ebp, dword [esi + 0x2baae4]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x21f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x6b7bda
sub esp, 0xffffff80
jmp 0x5fd360
Function at 0x420374
Capabilities:
Encode data using xor

Disassembly:
cmpsb byte [esi], byte es:[edi]
outsb dx, byte [esi]
jg 0x420381
xchg byte [edx - 0x3db92ed7], dh
push ebx
inc esi
mov bh, 0xf2
xchg ecx, eax
retf 0x10f
loop 0x420389
scasb al, byte es:[edi]
sahf
je 0x42035a
xor byte [esi - 0x25], ah
adc bl, byte [eax]
stc
pop ds
xchg esi, eax
jae 0x42035e
cmp edx, dword [edx - 0x7200f08b]
or dword [0x206652cb], esi
lea ecx, [ecx]
xor eax, 0x206652cb
xchg ecx, eax
mov ebx, 0xd0e64395
and ah, byte [eax + 0x59]
jp 0x4203e2
mov al, byte [0x62d763ed]
pop ss
add edx, dword [ecx + 0x55f3b74a]
fimul dword [0x75a3579a]
pop esp
invalid
adc byte [0xc69c27c0], bl
inc edx
add bl, byte [edx - 0x1c605a89]
xchg ebp, eax
pop esp
push edx
out dx, al
mov dword [edi - 0x1c], edx
daa
movups xmm2, xmmword [eax]
xor dword [edi], 0x16
mov ebp, 0x14148521
lodsb al, byte [esi]
adc al, 0xac
insb byte es:[edi], dx
dec edi
shl edx, cl
push esi
sti
xlatb
push 0xa7a6b075
xchg edi, eax
sar esi, 1
inc ecx
mov ebx, 0x2fd80f74
jle 0x4203c3
jb 0x4203d4
cmpsd dword [esi], dword es:[edi]
mov bh, 0x62
arpl word [edx], bx
or edi, esi
mov esp, 0xa18af0
invalid

Function at 0x42e730
Capabilities:
Encode data using xor

Disassembly:
ror byte [ecx + 0x5d], 0xe7
adc esp, dword [eax - 0x4b2bfc69]

Function at 0x43a994
Capabilities:
Encode data using xor

Disassembly:
mov cl, 0xcf
test al, 0xd4
dec edx
pushfd
lahf
stosb byte es:[edi], al
xchg esp, eax
inc edi
push edx
aad 0x4f
fidiv word [eax]
inc eax
inc esi
xor byte [eax + 0x46], al
xchg dword [ecx + 0x681c6f1c], ebx
cli
push ecx
jl 0x43a8cd
cli
cmpsd dword [esi], dword es:[edi]
rcr dword [ebp + 0x1fe78d2b], 1
add byte [eax + esi - 0x40771c42], 0x8e
neg byte [edi - 0x37]
movsb byte es:[edi], byte [esi]
inc esp
xchg esi, esi
mov cl, 0xf9
fistp word [esp + esi*4 - 0x20]
sbb dword [ebx], ecx
lahf
jmp dword [edi]
adc byte [0x9e4baff2], cl
or eax, 0x9e4baff2
rcl bl, 0x18
sub bl, byte [ecx + 0x6ff825fd]
adc bl, ah
sbb dl, byte [ebp + 0x10]
bound esp, qword [ebp - 0x6a7c4cea]
or byte [eax], dl
jl 0x43a8be
sbb bh, bh
test byte [edi + 0x17], dl
inc ecx
xchg esi, eax
push ebx
out 0xa2, eax
and al, 0xb7
and al, 0xb7
inc ebp
mov esi, 0xe0e44265
add al, 0x8a
xchg esp, eax
pop ebp
mov dword gs:[ebx - 0x6819efb], ecx
imul ebp, dword [esi - 0x7d], 0xace59184
stosb byte es:[edi], al
inc eax
jb 0x43a978
and al, 0xc7
and byte [ebx], ch
bound eax, qword [ebp + 0x90d3983]
xchg ebx, eax
or dword [ebp + 0x45], ecx
inc di
push 0x37
arpl sp, bp
sbb byte [edx + 0x6f], 0x37
in eax, 0xec
add al, 0x8f
and ah, byte [eax + 0x12]
push ss
add eax, 0x907c5506
push es
push ebp
jl 0x43a90c
and byte [esi - 0x7c], bh
jno 0x43a90d
cmp dword [edx], 0x62
inc ecx
out dx, eax
jmp 0x43a9ad
push esi
ja 0x43a938
rol byte [ecx], cl
mov byte [esi - 0x80], dh
sahf
dec edx
cmp dword [esi + 0x22], edx
xchg esi, eax
fbld tbyte [ebp + 0x4077da40]
lahf
das
mov ecx, 0x6e20aad5
xchg edx, eax
stosb byte es:[edi], al
and byte [esi - 0x6e], ch
lodsd eax, dword [esi]
inc eax
lodsd eax, dword ss:[esi]
lodsb al, byte es:[esi]
dec edx
jl 0x43aa38
jb 0x43aa03
invalid
outsd dx, dword [esi]
invalid
jmp 0x4137a426