joyce8/EMBER2024-capa huggingface dataset:
Function at 0x408ac0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
nop
movzx ecx, word [edx + 0x26]
nop
xor edi, edi
jmp 0x4089eb
mov esi, dword [edx + 0x28]
nop
nop
xor eax, eax
nop
jmp 0x4089fe
lodsb al, byte [esi]
nop
jmp 0x408a0d
cmp al, 0x61
jmp 0x408a1d
jl 0x408a44
jmp 0x408a2a
jmp 0x408a38
sub al, 0x20
jmp 0x408a44
jmp 0x408a54
ror edi, 0xd
add edi, eax
dec ecx
nop
jmp 0x408a6a
jne 0x4089ef
jmp 0x408a7b
jmp 0x408a8c
push edx
push edi
mov edx, dword [edx + 0x10]
nop
jmp 0x408a9e
mov eax, dword [edx + 0x3c]
jmp 0x408ab1
add eax, edx
nop
mov eax, dword [eax + 0x78]
test eax, eax
nop
je 0x408c93
jmp 0x408acb
nop
add eax, edx
jmp 0x408ade
mov ebx, dword [eax + 0x20]
nop
mov ecx, dword [eax + 0x18]
add ebx, edx
jmp 0x408af2
push eax
nop
jmp 0x408afe
jmp 0x408b0e
test ecx, ecx
jmp 0x408b1c
je 0x408c73
nop
nop
dec ecx
nop
jmp 0x408b37
mov esi, dword [ebx + ecx*4]
add esi, edx
xor edi, edi
nop
xor eax, eax
lodsb al, byte [esi]
nop
jmp 0x408b53
ror edi, 0xd
add edi, eax
cmp al, ah
jne 0x408b3e
jmp 0x408b71
nop
add edi, dword [ebp - 8]
nop
jmp 0x408b84
cmp edi, dword [ebp + 0x24]
nop
jmp 0x408b9c
jne 0x408afe
nop
jmp 0x408bb0
pop eax
nop
jmp 0x408bc1
mov ebx, dword [eax + 0x24]
nop
add ebx, edx
jmp 0x408bd7
mov cx, word [ebx + ecx*2]
nop
jmp 0x408bf0
mov ebx, dword [eax + 0x1c]
nop
jmp 0x408c04
add ebx, edx
nop
jmp 0x408c1a
mov eax, dword [ebx + ecx*4]
jmp 0x408c2f
add eax, edx
mov dword [esp + 0x24], eax
nop
pop ebx
nop
jmp 0x408c47
pop ebx
jmp 0x408c58
popal
nop
pop ecx
pop edx
push ecx
jmp eax
nop
jmp 0x408c83
pop eax
nop
jmp 0x408c93
pop edi
pop edx
jmp 0x408ca9
mov edx, dword [edx]
jmp 0x408cbb
jmp 0x4089d4

Function at 0x4090a2
Capabilities:
Set socket configuration

Disassembly:
pop edi
call fcn.00409013
cmp byte [ecx], bh
xor dword cs:[ecx], edi
aaa
xor dword cs:[0x31312e34], esi
invalid
invalid
Function at 0x40bed0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x50
mov esi, esp
mov dword [esi + 0x20], ecx
lea eax, [ebp + 8]
mov dword [esi + 0x24], eax
mov eax, dword [0x446080]
xor eax, ebp
mov dword [esi + 0x48], eax
mov dword [esi + 0x2c], 0xb1b432cb
mov eax, dword [esi + 0x2c]
mov dword [esi + 0x1c], eax
sub eax, 0x9390d9ee
je 0x40c0eb
jmp 0x40bf0e
mov eax, dword [esi + 0x1c]
sub eax, 0xb1b432cb
je 0x40bf5f
jmp 0x40bf21
mov eax, dword [esi + 0x1c]
sub eax, 0x2b0a051e
je 0x40bfca
jmp 0x40bf34
mov eax, dword [esi + 0x1c]
sub eax, 0x6f2479da
je 0x40c030
jmp 0x40bf47
mov eax, dword [esi + 0x1c]
sub eax, 0x7a04cbd9
je 0x40c03c
jmp 0x40bf5a
jmp 0x40c0f2
mov ecx, dword [0x4475c4]
mov eax, dword [0x4475c0]
xor edi, edi
sub edi, 1
mov edx, ecx
add edx, edi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x9390d9ee
mov ecx, 0x2b0a051e
test dl, 1
cmovne eax, ecx
mov dword [esi + 0x2c], eax
jmp 0x40c0f2
mov eax, dword [esi + 0x24]
push eax
push eax
mov ecx, esp
and ecx, 0xfffffff8
mov esp, ecx
mov dword [esi + 0x38], ecx
push eax
mov ecx, esp
mov dword [esi + 0x3c], ecx
push eax
mov ecx, esp
mov dword [esi + 0x40], ecx
mov eax, dword [eax]
mov dword [esi + 0x44], eax
mov eax, dword [0x4475c4]
mov ecx, dword [0x4475c0]
xor edi, edi
sub edi, 1
mov edx, eax
add edx, edi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x9390d9ee
mov ecx, 0x6f2479da
test dl, 1
cmovne eax, ecx
mov dword [esi + 0x2c], eax
jmp 0x40c0f2
mov dword [esi + 0x2c], 0x7a04cbd9
jmp 0x40c0f2
mov ecx, dword [esi + 0x24]
mov eax, dword [esi + 0x20]
mov edx, ecx
add edx, 4
mov dword [esi + 4], edx
mov edx, ecx
add edx, 0x1c
mov dword [esi + 8], edx
mov edx, ecx
add edx, 0x38
mov dword [esi + 0xc], edx
mov edx, ecx
add edx, 0x60
mov dword [esi + 0x10], edx
add ecx, 0x78
mov dword [esi + 0x14], ecx
mov dword [esi + 0x34], eax
mov dword [esi + 0x30], 0x1a4
mov eax, dword [esi + 0x38]
vmovsd xmm0, qword [0x43e250]
vmovsd qword [eax], xmm0
mov eax, dword [esi + 0x3c]
mov dword [eax], 0x1572
mov eax, dword [esi + 0x40]
mov byte [eax], 1
mov ecx, dword [esi + 0x44]
lea eax, [0x43e9d0]
sub esp, 4
mov dword [esp], eax
call fcn.004240d0
mov ecx, dword [esi + 4]
call fcn.00424870
mov ecx, dword [esi + 8]
call fcn.00424870
mov ecx, dword [esi + 0xc]
call fcn.00424870
mov ecx, dword [esi + 0x10]
call fcn.00424870
mov ecx, dword [esi + 0x14]
call fcn.00424870
mov eax, dword [esi + 0x24]
mov eax, dword [eax]
mov dword [esi + 0x18], eax
mov ecx, dword [esi + 0x48]
xor ecx, ebp
call fcn.0042ebf0
mov eax, dword [esi + 0x18]
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 0x9c
mov dword [esi + 0x2c], 0x2b0a051e
jmp 0x40bef8
Function at 0x4146f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
sub esp, 0x1c
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x18], eax
mov eax, dword [0x446080]
xor eax, ebp
mov dword [ebp - 8], eax
mov dword [ebp - 0x14], 0x283a1f83
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x20], eax
sub eax, 0x283a1f83
je 0x414742
jmp 0x41472a
mov eax, dword [ebp - 0x20]
sub eax, 0x5790f118
je 0x414754
jmp 0x41473d
jmp 0x41479b
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x14], 0x5790f118
jmp 0x41479b
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x10], eax
pop eax
push eax
mov eax, eax
xor eax, 0x85
nop
mov ecx, dword [ebp - 0xc]
mov edi, dword [ebp - 0x10]
not byte [edi]
pop eax
push eax
mov eax, eax
xor eax, 0x85
nop
add byte [edi], 0x87
sub byte [edi], 0x35
pop eax
push eax
mov eax, eax
xor eax, 0x85
nop
imul byte [edi]
inc edi
loop 0x41476a
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0042ebf0
add esp, 0x1c
pop edi
pop ebp
ret
jmp 0x414714
Function at 0x4147a0
Capabilities:
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
sub esp, 0x20
mov eax, dword [ebp + 8]
mov eax, dword [ebp + 8]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x1c], 0x2c5820cc
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
sub eax, 0x954b88f1
je 0x4149d8
jmp 0x4147ce
mov eax, dword [ebp - 0x20]
sub eax, 0x9f524750
je 0x4148ce
jmp 0x4147e1
mov eax, dword [ebp - 0x20]
sub eax, 0xa0a8f91e
je 0x4148e0
jmp 0x4147f4
mov eax, dword [ebp - 0x20]
sub eax, 0xcfc27958
je 0x4148b2
jmp 0x414807
mov eax, dword [ebp - 0x20]
sub eax, 0xdb9bc6ed
je 0x41496d
jmp 0x41481a
mov eax, dword [ebp - 0x20]
sub eax, 0xf98ba50f
je 0x4149df
jmp 0x41482d
mov eax, dword [ebp - 0x20]
sub eax, 0x8d04799
je 0x414889
jmp 0x414840
mov eax, dword [ebp - 0x20]
sub eax, 0x2c5820cc
je 0x41486b
jmp 0x414853
mov eax, dword [ebp - 0x20]
sub eax, 0x75175d4b
je 0x414902
jmp 0x414866
jmp 0x4149e6
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
sub esp, 4
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x1c], 0x8d04799
jmp 0x4149e6
mov eax, dword [ebp - 0x18]
mov ecx, 0xffffffff
xor ecx, 2
mov edx, eax
xor edx, ecx
and edx, eax
mov eax, 0x75175d4b
mov ecx, 0xcfc27958
cmp edx, 0
cmove eax, ecx
mov dword [ebp - 0x1c], eax
jmp 0x4149e6
mov ecx, dword [ebp - 0x18]
mov eax, ecx
and eax, 2
xor ecx, 2
or eax, ecx
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x1c], 0x9f524750
jmp 0x4149e6
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x1c], 0xa0a8f91e
jmp 0x4149e6
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword [esp], ecx
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
sub esp, 8
mov dword [ebp - 0x1c], 0x75175d4b
jmp 0x4149e6
mov ecx, dword [0x44757c]
mov eax, dword [0x447578]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xf98ba50f
mov ecx, 0xdb9bc6ed
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1c], eax
jmp 0x4149e6
mov ecx, dword [0x44757c]
mov eax, dword [0x447578]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xf98ba50f
mov ecx, 0x954b88f1
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1c], eax
jmp 0x4149e6
add esp, 0x20
pop esi
pop ebx
pop ebp
ret
mov dword [ebp - 0x1c], 0xdb9bc6ed
jmp 0x4147b8
Function at 0x42f4bb
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x42f4fa
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x42f4fa
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x42f4fa
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x42f4fa
cmp dword [ecx + 0x74], 0xe
jbe 0x42f4fa
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x436c5b
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x436cf8
push ebx
push esi
call fcn.00436c24
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.00436bb8
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x436ca5
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x436cf7
push edi
push eax
call fcn.004356f0
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x436cc5
call fcn.0043573e
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x436cf6
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.00436bb8
add esp, 0x20
test eax, eax
jne 0x436ce4
push edi
call fcn.0043573e
jmp 0x436cec
push ebx
call fcn.0043573e
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x437f07
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x441220
push 0x441218
push str.FlsAlloc
push 0x1f
call fcn.00437dc6
mov esi, eax
add esp, 0x10
test esi, esi
je 0x437f3b
push dword [ebp + 8]
mov ecx, esi
call dword [0x43e14c]
call esi
jmp 0x437f41
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x437f85
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x441230
push 0x441228
push str.FlsGetValue
push 0x21
call fcn.00437dc6
mov esi, eax
add esp, 0x10
test esi, esi
je 0x437fbc
push dword [ebp + 8]
mov ecx, esi
call dword [0x43e14c]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x437fc4
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x441238
push 0x441230
push str.FlsSetValue
push 0x22
call fcn.00437dc6
mov esi, eax
add esp, 0x10
test esi, esi
je 0x437ffe
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x43e14c]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0xc8bd5b
Capabilities:
Encode data using xor

Disassembly:
mov dword [esp], 0x6fde2bae
call fcn.00d0bea5
dec ebp
pop eax
cpuid
cmp byte [esi - 0xeeaa408], 0x1d
mov ch, 0xcb
or al, 0x8f
pop ecx
pop ecx
adc al, byte [ebp + 0x67e8b5ba]
or eax, 0xeabf1bd1
and al, 0xe3
jle 0xc8bddd
jno 0xc8bdcb
and eax, 0x5859f2f0
btr dword [eax + 0xb67f9bc], eax
invalid
je 0xc8be13
or byte [esi - 0x77], ah
dec eax
cmp byte [edi], dh
inc ebp
invalid
cmp al, 0xb6
push edi
int1
enter 0xffffffffffffae62, 0
loope 0xc8be7c
call fcn.00c85c45
jg 0xc8be08
invalid
inc edi
lcall 0x4082, 0x21e3ba87
insb byte es:[edi], dx
jl 0xc8be6c
jecxz 0xc8be8f
add byte [eax + 0x6c], 0x7c
stc
lodsb al, byte [esi]
fcmovbe st(0), st(0)
cmc
mov edx, ebp
jecxz 0xc8bed4
xor cl, ah
ljmp 0x74f9
loope 0xc8be68
add dword [edi - 0xd], ebx
daa
stc
je 0xc8bea6
xor al, 0x2a
xchg edi, eax
xlatb
add edi, ebx
or eax, 0x123010fb
out 0xc0, al
cmpsd dword [esi], dword es:[edi]
dec ecx
hlt
adc ah, dh
shl byte [edi - 0x1da90bb7], 0x96
mov dh, 0x90
movsb byte es:[edi], byte [esi]
pop ss
invalid
jmp 0xf702c7fa
sbb al, byte [0xcf72780e]
or esp, edx
clc
mov esp, 0x8967a789
add byte [0x3d54a311], al
in al, dx
retf
xor dword [eax + 0x4c247970], ebp
sub esi, ebp
pop ds
cmc
inc ebp
pop ds
pop eax
jns 0xc8bea1
xchg edx, eax
iretd
Function at 0xde1046
Capabilities:
Encode data using xor

Disassembly:
dec ecx
sub ebp, 2
inc cx
mov dword [ebp], edx
jmp fcn.00e02fa3
xor dword [esp + 4], 0x5d287221
xor bl, al
dec word [esp + 4]
jne 0xcfaa9f
inc ecx
mov ecx, 0x740ca6b4
inc ecx
sal cl, 0xa4
inc ecx
movzx edx, cx
dec eax
lea ebx, [edx + ebx - 0xa642]
inc cx
xchg ecx, edx
inc esp
movzx ecx, word [ebx + edx*8 - 0x53200]
shr dx, 0xab
inc bp
xor ecx, esi
inc cx
ror ecx, 1
dec edx
inc cx
inc ecx
sal edx, 0xbb
inc cx
rol ecx, 1
inc cx
not ecx
dec eax
sub edx, edx
setnp dl
inc cx
dec ecx
rol edx, 0x43
bswap edx
bswap edx
inc bp
xor esi, ecx
dec esp
add ecx, esp
inc edx
xor dl, byte [edx + ecx]
jmp 0xc7d114
dec edx
sub al, byte [eax + 0x7de5a28c]
or al, 0xdb
sbb eax, 0xfb2cc1a9
jnp 0xcfab10
jo 0xcfab12
and dh, al
xchg edi, eax
mov cl, 0xef
add dword [ebp - 0x77f7fbbc], ecx
adc byte [ebp + 0xf082464], cl
mov ch, byte [ebx + 0x5900464c]
lea eax, [esp + eax + 8]
mov byte [eax], dl
lea esp, [esp + 8]
jp fcn.0115f75a
pop ecx
pop eax
cpuid
cmp byte [esi - 0x10eaa408], 0x17
mov eax, 0xfc5a4dd8
jle 0xcfaafa
xchg ebx, eax
dec esp
salc
xchg dword gs:[ecx], edx
stosd dword es:[edi], eax
mov esp, 0xa00ffd76
jp 0xcfaa87
push 0x4d
cmpsd dword [esi], dword es:[edi]
xor dl, bl
cmp eax, 0x11bb1597
and eax, dword [edx - 0x10]
sbb al, 0x83
sub eax, 0xc8e6fe1
xor eax, 0x14f56fa3
xchg edx, eax
stosd dword es:[edi], eax
cmp ebp, esi
pop edi
mov esi, 0x4f833900
in eax, dx
lodsb al, byte [esi]
lcall 0xa314, 0xf655ffb8
imul ebx, dword [ebx + 0x2bbc6669], 0x428002c1
mov dword [0x66699b69], eax
mov esp, 0x8002c12b
inc edx
nop
xchg ebx, eax
push ecx
invalid
invalid
inc edx
invalid
salc
dec ecx
xlatb
sbb eax, dword [ebp + 0x45d3ea64]
mov dword [edi], esp
mov byte [ebp + edi*2 - 0x19], 0x2b
lodsd eax, dword [esi]
dec esp
fsubrp st(7)
pop ecx
xchg ebp, eax
aaa
or esp, dword [ecx + 0x75d67c3b]
xchg edi, eax
adc dl, bh
or dl, bh
cmc
das
cld
jle 0xcfab0e
pop es
cmp eax, 0x4dca541f
mov eax, dword [0xb11fc2d6]
jo 0xcfaae9
inc esp
mov esp, 0xf4e0b57f
jmp 0xcfab9f
xchg edi, eax
lahf
push ecx
rcr al, 1
salc
pop ebp
imul ebx, dword [edi + 0xa], 7
pop es
adc eax, 0xea0de7d5
mov ecx, 0xbb0628af
sub ebx, dword [0x35cc2113]
xlatb
xor eax, 0x869797c
xor cl, byte [edx + 0x23353f80]
sti
mov cl, 0x5a
xor eax, 0x4d9ceee5
push ss
mov dword [0xe1debe7c], eax
aaa
jb 0xcfab95
mov edx, 0xeb6faf32
xchg esi, eax
xchg ebx, eax
sbb dword [esi], 0x4b
out dx, al
hlt
not al
inc al
jmp 0xc8e0d4
sub al, 0x86
jmp 0xd00178
Function at 0xdf9e8d
Capabilities:
Encode data using xor

Disassembly:
test edi, edi
jmp 0xc93c21
ret
mov esp, ebp
pop ebp
jmp 0xc91131
mov edi, dword [ecx + edx + 0x18]
jmp 0xc8c293
mov dword [ebp - 8], 0xffffffff
test bp, bx
cmp esi, 0xffff
ja 0xd10804
mov eax, esi
sub eax, dword [ecx + edx + 0x10]
jmp 0xdf665e
mov dword [esp], edi
movzx edi, byte [edx]
push 0xd929ac9e
or word [esp], 0xb80f
xor edi, eax
push 0xc01a7e16
and edi, 0xff
mov edi, dword [edi*4 + 0xd07be8]
shr eax, 8
dec byte [esp + 4]
push 0xd9ad8237
sar dword [esp + 8], 0x46
xor eax, edi
inc edx
xor eax, 0x1c0a0413
dec ebp
push 0x651e1538
lea esp, [esp + 0x10]
jne 0xde2212
pop edi
call fcn.00e0914d
je 0xe06085
mov eax, dword [eax + 0x7c]
push ebx
cmc
stc
push edi
cmp bl, 0x29
mov dword [ebp - 0x10], eax
jmp 0xd1214e
jmp 0xde1008
jmp 0xde220f
sub eax, eax
bswap esi
pop esi
jmp 0xd0af2b

Function at 0xe00e50
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
test ecx, ecx
jmp 0xde2263
mov eax, dword [edx + 0x3c]
test sp, cx
test bl, 0x8a
cmp edi, 0x751c4007
lea eax, [eax + edx]
cmp dword [eax], 0x4550
jmp 0xdfa0da
jne 0xe06085
mov ecx, dword [eax + 0x78]
cmp esi, 0xc2027f86
cmp edx, ebx
mov dword [ebp - 4], ecx
jmp 0xc76311
push ebp
mov dh, 0x2d
movsx dx, ah
mov ebp, esp
adc dx, bp
xchg dl, dh
shld edx, esp, 0x22
mov edx, dword [ebp + 8]
sub esp, 0x114
cmp esi, eax
cmc
push esi
test edx, edx
jmp 0xe07e86
je 0xe06085
mov eax, 0x5a4d
cmc
cmp word [edx], ax
je 0xd0ac46
je 0xe06085
mov esi, dword [ebp + 0xc]
stc
test esi, esi
jmp 0xe06070

Function at 0xe06065
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
xor bl, al
lea eax, [esp + eax + 0xc]
call fcn.00df17f6
Function at 0x115b9ab
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [sym.imp.kernel32.dll_HeapFree]
call eax
ret
adc edi, 4
shld dx, bp, cl
mov word [edi], dx
lea esp, [esp + 4]
jmp fcn.0115f75a
jae 0xe0d22b
imul ebx, dword [ebp + ecx - 0x70], 0x64e8a5a6
adc al, bl
add bh, byte [edx + 0x77c728de]
ja 0x115ba3d
dec eax
cmp byte [edx + 0x4f0f6650], al
ret 0xf66
push edx
cwde
jmp 0xc91409
dec esi
scasd eax, dword es:[edi]
add eax, 0xcc4e823c
sub eax, 0xe020ae97
inc esi
les eax, [ebx - 0x57]
jae fcn.0115b9ab
into
je 0x115b9d0
cmp dword [esi + 0x477cee4c], edx
mov ch, 0x12
fmul dword [ebx - 0x6d56a457]
pushal
wait
xor eax, 0xf1983347
dec edx
aad 0x5b
invalid
hlt
mov esi, 0x4a73e908
clc
xor al, 0x9e
jg 0x115ba08
clc
jp 0x115baa5
std
jg 0x115ba1d
or cl, byte [eax - 0xdb6a2ee]
and al, 0x8a
wait
inc edx
xchg edi, eax
dec ebp
inc edx
cwde
fnsave dword [0xbe6f06bc]
wait
popal
sub byte [ebx], 0x20
jle 0x115ba3b
cmp dword [ebx + 0x71875b2f], ebx
rcl byte [ebp + 0x696ae78], 0x34
hlt
xchg ebx, eax
dec edi
test dword [ecx + 0x5a6cb15b], edx
in eax, dx
jecxz 0x115bb02
pop es
ljmp 0xa211
mov byte [ecx - 0x55], ah
pop ebp
movsd dword es:[edi], dword [esi]
outsd dx, dword [esi]
pushal
mov byte [esi - 0x4b], bh
or byte [esi - 0x299ef7ff], ch
push es
lcall 0xf408, 0xebce623c
pop ds
ror dword [ebx - 0x78], 1
push esp
out 0x88, eax
adc byte [eax - 0xe], 0x46
xor dh, byte [edi - 0x78]
sbb al, 0xda
cmp eax, 0xc5fb7c8a
std
div byte [edx + 0x4ca66c78]
dec eax
jbe 0x115bb06
retf
Function at 0x4282a0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x17000]
push edi
jmp 0x4282ba
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x4282c1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4282b0
mov eax, 1
add ebx, ebx
jne 0x4282d3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x4282c8
jne 0x4282e4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4282c8
xor ecx, ecx
sub eax, 3
jb 0x4282f8
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x42836a
mov ebp, eax
add ebx, ebx
jne 0x428303
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x428310
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x428334
inc ecx
add ebx, ebx
jne 0x428320
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x428315
jne 0x428331
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x428315
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x428354
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x428345
jmp 0x4282b6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x428354
add edi, ecx
jmp 0x4282b6
pop esi
mov edi, esi
mov ecx, 0x115
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x428372
cmp byte [edi], 3
jne 0x428372
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x428377
lea edi, [esi + 0x26000]
mov eax, dword [edi]
or eax, eax
je 0x4283e6
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x28000]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x280c4]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x4283a4
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x280cc]
or eax, eax
je 0x4283e0
mov dword [ebx], eax
add ebx, 4
jmp 0x4283c1
call dword [esi + 0x280c8]
mov ebp, dword [esi + 0x280d0]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1ef]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x42841a
sub esp, 0xffffff80
jmp 0x409ac0

Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x407ef8
mov ecx, 0x4b103773
nop
nop
nop
nop
nop
test eax, eax
je 0x42e04e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x42e024
nop
nop
nop
mov eax, section..data
nop
nop
mov ebx, 0x42cd70
mov ecx, 0xc0f260c
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x42e084
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
add eax, 4
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x42e06c
nop
nop
nop
nop
popal
nop
jmp 0x401219
Function at 0x17e2058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.017e21a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x17e207e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x17e206a
add dl, dl
jne 0x17e2089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x17e20dc
xor eax, eax
add dl, dl
jne 0x17e2096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x17e217d
add dl, dl
jne 0x17e20a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x17e20b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x17e20bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x17e20c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x17e20d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x17e2075
mov eax, 1
add dl, dl
jne 0x17e20ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x17e20f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x17e20e1
sub eax, ebx
mov ebx, 1
jne 0x17e2128
mov ecx, 1
add dl, dl
jne 0x17e210e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x17e2119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x17e2105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x17e2075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x17e213f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x17e214a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x17e2136
cmp eax, 0x7d00
jae 0x17e216d
cmp eax, 0x500
jb 0x17e2168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x17e2075
cmp eax, 0x7f
ja 0x17e2170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x17e2075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x17e219e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x17e2075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10