joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4071d9
Capabilities:
Encode data using xor

Disassembly:
call fcn.00407074
sub ecx, ecx
sub ecx, 0xffffff98
call 0x4071d9
rcr byte [esi - 0x7f], 0x76
push cs
mov esi, 0x83b60550
out dx, al
cld
xor dword [esi + 0xe], 0xb60550be
sub esi, 0xfffffffc
loop 0x4071dc
aam 0x32
pop esp
outsd dx, dword [esi]
push eax
mov dword [ecx - 0x6e], esi
dec edx
or eax, dword [ebp + eax*8 + 0x5dcdb8ad]
rcl ebx, 0xee
dec edx
pop esp
movsb byte es:[edi], byte [esi]
push esp
or eax, 0x96ed2f54
stosb byte es:[edi], al
rcl byte [edx]
adc dword [ecx + esi*2 + 0x285b32dd], 0x4ced840f
out dx, eax
jp 0x407265
rcl dword [0x27daa389], 0x2c
push 0xa669ec6d
mov dword [ebx], 0xff3dcc80
pushal
sub ecx, dword [ebp + 0x7459a6e1]
add cl, byte [ebx - 0x6a]
lea eax, [eax + ebp*8 + 0x4f]
retf
jl 0x4072b6
dec edi
and dword [ebx + 0x25], 0x1a
ror byte [edi + 0x71], 1
invalid
fbstp tbyte gs:[eax]
dec edx
out dx, al
je 0x40728c
pop ebx
mov eax, 0x2c472436
and byte [ecx], al
call 0xbd81c6a2
sub al, 0x1f
in al, 0xa2
rcl dl, cl
push ecx
mov esp, 0xb71d1f05
sbb byte ds:[eax + 0x1ddb4070], 0xa3
je 0x407258
mov dword [0x9fc87465], eax
lahf
fmul st(4), st(0)
out dx, al
sub cl, dl
push esp
or esi, ebx
rcr dword [esi], 0x5b
sub cl, bl
xchg esp, eax
xchg ecx, eax
imul esi, dword [ebx + edi*4 - 0x5b9998b4], 1
adc ah, byte [edi - 0x52]
xchg edi, eax
mov dword [0xf00aa065], eax
invalid
and byte [0x48ed2e03], bl
arpl word [ebp - 0x58], si
and ecx, dword [ecx + 0x62]
stosd dword es:[edi], eax
add byte [edi], cl
dec edx
fldenv [edi - 0x3e]
aad 0
mov eax, 0x10feadfb
cmp esi, dword [ebx + ebx*2 + 0x5c]
jae 0x40730b
mov dh, 0x80
inc eax
pop ebp
pushal
fisttp qword [ecx + 0x57]
dec ecx
push edi
not eax
mov esp, 0x4100d619
cmp eax, 0xdbc245c1
scasd eax, dword es:[edi]
cmp byte [ebx], dl
insd dword es:[edi], dx
mov edi, 0xb74d3b00
mov byte [0xbf3fc26c], al
mov esi, 0x3558b58a
dec edx
mov bh, 0xc9
fimul word [ecx - 0x62]
xchg edi, eax
xchg esi, eax
mov eax, 0xc241143f
mov cl, 0x60
pushal
rcl dword ss:[edi]
idiv dword [ebx - 0x5c1de023]
mov bh, 0x1b
salc
cld
mov ch, 0x1d
push ecx
imul eax, dword [edx - 0x3ac7ba20], 0xffffffff
push ss
jne 0x4072dc
leave
or cl, byte [ebx]
push ebp
invalid
Function at 0x407ef0
Capabilities:
Encode data using xor

Disassembly:
dec eax
sub cl, byte [ebx + 0x51500f55]
push ecx
push edx
call fcn.00407ef0
test byte [eax - 0x3d], ah
pop ebp
ret
push ebp
mov ebp, esp
sub esp, 0x14
cmp dword [ebp + 0x10], 0x4f
jl 0x407f03
and byte [ebp + 0x10], al
dec esi
shl dword [ebx], cl
add ch, bl
inc ebp
or ah, bl
je 0x407f39
fld qword [ebp + 8]
fdiv qword [eax + esi - 0x3e]
xor dl, al
ret 0x49
dec ecx
add byte [ebx + 0x5953184d], cl
pop ds
and byte [esi + 0x33], dl
not byte [edi - 0x21]
loopne 0x407ea3
jne 0x407edb
sbb byte [ecx], dh
adc al, 0xd6
cmpsd dword [esi], dword es:[edi]
mov esi, ebp
jp 0x407f33
inc ebp
or cl, bl
loopne 0x407f08
pop ebp
or byte [0x10c], ch
add byte [ebx + 0x550e0ce5], cl
mov esp, ebp
or al, 0xe
push ebp
or byte [ebp + 0x519bec45], cl
lea eax, [ebp - 0x14]
wait
push ecx
push edx
call dword [0x98c118]
fstp qword [ebp + 8]
movsb byte es:[edi], byte [esi]
test al, 0xfb
lcall 0x8372, 0x40c2301d
xor dl, al
inc eax
jb 0x407ed5
inc edx
or al, 0xdf
loopne 0x407f4d
les eax, [ebx + edi*2 + 0x72]
lea esi, [ebx + 0x50]
cmp esi, ebx
jbe 0x407fba
rol byte [ebp - 0x14], 1
in al, dx
mov dh, 0x1d
xor ch, al
inc eax
add bh, bl
loopne 0x407f64
les eax, [esp + edi*8 + 0x48]
fld qword [ebp - 0x14]
fmul qword [0xbc40c310]
lea eax, [ebp - 0x14]
push eax
sub esp, 8
fistp dword [esp]
ljmp 0xdda9
lea edx, [ebx + 0x73f03b50]
pop esp
mov dl, byte [esi]
mov byte [edi], dl
inc edi
inc esi
cmp ebp, esp
jb 0x407fd9
jmp 0x40801d
sbb eax, 0x40c230
and eax, 0x410025e0
add byte [eax], al
jne 0x40801d
add byte [ecx], al
add byte [ebp + 0x3e], dh
fld qword [ebp + 8]
fmul qword [0x16c2f8]
fst qword [edi]
hlt
mov eax, dword [ebp + 0x10]
lea esi, [eax + ebx]
rol byte [ebp + 0x1c], 1
test eax, eax
jne 0x408024
inc ebp
sbb al, 0x85
sal byte [ebp - 6], 3
jne 0x407fd1
add esi, dword [ebp - 0x5c]
imul dword [esp + edx]
cmp esi, ebx
jae 0x408047
mov eax, dword [ebp + 0x10]
dec ebp
neg eax
mov dword [ecx], eax
retf
mov edx, dword [ebp - 4]
cmp esi, dword [esi - 0x77]
adc dword [edi + 0x3c], esi
out dx, eax
inc ebp
or byte [ebp - 0x7c4afbd], cl
jae 0x40808a
fmul qword [0x40c2f8]
lea eax, [ebp - 0xc]
push eax
sub esp, 8
fisttp qword [0x1815ff24]
rol dword [eax], 0xdd
inc ebp
hlt
fstp st(0)
lea edx, [ebx + 0x50]
cmp esi, edx
jb 0x4080a0
pop edi
mov byte [ebx + 0x4f], 0
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dl, byte [esi]
mov eax, esi
add dl, 5
cmp dl, 0x39
mov byte [esi], dl
jle 0x4080d6
mov eax, dword [esp + ebx]
cmp esi, ebx
invalid
mov byte [eax], 0
fisttp word [ebx - 0x74a4a13d]
in eax, 0x5d
ret
Function at 0x431002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40915c
mov ecx, 0x369b5716
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
je 0x43104e
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x431024
nop
mov eax, section..data
nop
nop
mov ebx, 0x42f3f8
nop
mov ecx, 0x38e82a32
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x431084
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
add eax, 4
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43106c
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x401219
Function at 0x63082772
Capabilities:
Hash data using sha1

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov dword [eax + 0x14], 0
mov dword [eax + 0x18], 0
mov dword [eax + 0x5c], 0
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x10], 0xc3d2e1f0
mov dword [eax + 0x60], 0
mov dword [eax + 0x64], 0
pop ebp
ret

Function at 0x63082a63
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edx
mov ebx, dword [ebp + 8]
mov eax, dword [ebx + 0x5c]
lea edx, [eax + 1]
cmp eax, 0x37
mov dword [ebx + 0x5c], edx
mov byte [ebx + eax + 0x1c], pe_nt_image_headers32
jle 0x63082ab0
mov eax, dword [ebx + 0x5c]
cmp eax, 0x3f
jg 0x63082a93
lea edx, [eax + 1]
mov dword [ebx + 0x5c], edx
mov byte [ebx + eax + 0x1c], 0
jmp 0x63082a7e
mov dword [esp], ebx
call fcn.630827bf
mov eax, dword [ebx + 0x5c]
cmp eax, 0x37
jg 0x63082ac5
lea edx, [eax + 1]
mov dword [ebx + 0x5c], edx
mov byte [ebx + eax + 0x1c], 0
jmp 0x63082a9b
mov eax, dword [ebx + 0x5c]
cmp eax, 0x37
jg 0x63082ac5
lea edx, [eax + 1]
mov dword [ebx + 0x5c], edx
mov byte [ebx + eax + 0x1c], 0
jmp 0x63082ab0
mov eax, dword [ebx + 0x18]
mov edx, eax
mov byte [ebx + 0x57], al
shr edx, 0x18
mov byte [ebx + 0x54], dl
mov edx, eax
shr edx, 0x10
mov byte [ebx + 0x55], dl
mov edx, eax
mov eax, dword [ebx + 0x14]
shr edx, 8
mov byte [ebx + 0x56], dl
mov edx, eax
mov byte [ebx + 0x5b], al
shr edx, 0x18
mov byte [ebx + 0x58], dl
mov edx, eax
shr edx, 0x10
mov byte [ebx + 0x59], dl
mov edx, eax
shr edx, 8
mov byte [ebx + 0x5a], dl
mov dword [ebp + 8], ebx
pop eax
pop ebx
pop ebp
jmp fcn.630827bf
Function at 0x630855e6
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x10
mov eax, dword [ebp + 8]
mov dword [esp], eax
call dword [0x631e5548]
test eax, eax
push ebx
je 0x63085731
mov ebx, eax
mov esi, dword [0x631e5518]
mov dword [esp + 4], 0x630c423c
mov dword [esp], eax
call esi
push edx
push edx
mov dword [0x631e3adc], eax
mov dword [esp + 4], 0x630c4245
mov dword [esp], ebx
call esi
push ecx
push ecx
mov dword [0x631e3ad8], eax
mov dword [esp + 4], 0x630c4252
mov dword [esp], ebx
call esi
push edx
push edx
mov dword [0x631e3ad4], eax
mov dword [esp + 4], 0x630c426a
mov dword [esp], ebx
call esi
push ecx
push ecx
mov dword [0x631e3ad0], eax
mov dword [esp + 4], 0x630c427c
mov dword [esp], ebx
call esi
push edx
push edx
mov dword [0x631e3acc], eax
mov dword [esp + 4], 0x630c428c
mov dword [esp], ebx
call esi
push ecx
push ecx
mov dword [0x631e3ac8], eax
mov byte [0x631e3ae1], 1
mov dword [esp + 4], 0x630c429a
mov dword [esp], ebx
call esi
push edx
push edx
mov dword [0x631e3ab8], eax
mov dword [esp + 4], 0x630c42a9
mov dword [esp], ebx
call esi
push ecx
push ecx
mov dword [0x631e3ab4], eax
mov dword [esp + 4], 0x630c42bc
mov dword [esp], ebx
call esi
push edx
push edx
mov dword [0x631e3ab0], eax
mov dword [esp + 4], 0x630c42c9
mov dword [esp], ebx
call esi
push ecx
push ecx
mov dword [0x631e3aac], eax
mov dword [esp + 4], 0x630c42dd
mov dword [esp], ebx
call esi
push edx
push edx
mov dword [0x631e3aa8], eax
mov dword [esp + 4], 0x630c42ee
mov dword [esp], ebx
call esi
push ecx
push ecx
mov dword [0x631e3ac0], eax
mov dword [esp + 4], 0x630c4300
mov dword [esp], ebx
call esi
push edx
push edx
mov dword [0x631e3abc], eax
mov dword [esp + 4], 0x630c4313
mov dword [esp], ebx
call esi
push ecx
push ecx
mov dword [0x631e3ac4], eax
mov byte [0x631e3ae0], 1
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret

Function at 0x63086861
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x1c
cmp byte [0x631e3ae1], 0
mov ebx, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
je 0x630868a7
cmp byte [0x631e3ae0], 0
je 0x630868a7
test ebx, ebx
je 0x630868a7
mov dword [esp], ebx
call fcn.630821d6
test eax, eax
jne 0x630868a7
add esp, 0x1c
mov ecx, edi
mov edx, esi
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
jmp fcn.63086698
add esp, 0x1c
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x63086aef
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x1c
cmp byte [0x631e3ae1], 0
mov ebx, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
je 0x63086b2c
test ebx, ebx
je 0x63086b2c
mov dword [esp], ebx
call fcn.630821d6
test eax, eax
jne 0x63086b2c
add esp, 0x1c
mov ecx, edi
mov edx, esi
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
jmp fcn.630868b1
add esp, 0x1c
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x6308792e
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x84c
cmp byte [0x631e3ae0], 0
mov edi, dword [ebp + 0xc]
je 0x63087acd
lea eax, [ebp - 0x81c]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call dword [0x631e3ab8]
test eax, eax
jne 0x63087acd
lea eax, [ebp - 0x820]
mov dword [esp + 0x10], 0
mov dword [esp + 8], 0xffffffff
mov dword [esp + 4], 0x630c44fe
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x81c]
mov dword [esp], eax
call dword [0x631e3ab4]
test eax, eax
jne 0x63087aaf
lea esi, [ebp - 0x818]
lea ebx, [ebp - 0x418]
mov eax, dword [ebp - 0x820]
mov dword [esp], eax
call dword [0x631e3ab0]
cmp eax, 0x64
jne 0x63087aaf
mov eax, dword [ebp - 0x820]
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [0x631e3aac]
mov dword [ebp - 0x830], eax
mov eax, dword [ebp - 0x820]
mov dword [esp + 4], 1
mov dword [esp], eax
call dword [0x631e3aac]
mov dword [ebp - 0x82c], eax
mov eax, dword [ebp - 0x820]
mov dword [esp + 4], 2
mov dword [esp], eax
call dword [0x631e3aac]
mov dword [esp + 4], esi
mov dword [esp], eax
call fcn.6308556a
mov ecx, dword [ebp - 0x830]
mov dword [esp], ebx
mov dword [esp + 4], ecx
call fcn.630abbb0
mov dword [esp + 4], 0x630c4454
mov dword [esp], ebx
call fcn.630abbc0
mov edx, dword [ebp - 0x82c]
mov dword [esp], ebx
mov dword [esp + 4], edx
call fcn.630abbc0
mov dword [esp + 4], 0x630c4454
mov dword [esp], ebx
call fcn.630abbc0
mov dword [esp + 4], esi
mov dword [esp], ebx
call fcn.630abbc0
mov dword [esp + 4], 0x630c4456
mov dword [esp], ebx
call fcn.630abbc0
mov dword [esp + 8], edi
mov dword [esp + 4], ebx
mov dword [esp], 0
call fcn.63086610
test eax, eax
jns 0x630879ad
mov dword [esp + 4], ebx
mov dword [esp], edi
call fcn.630abbc0
jmp 0x630879ad
mov eax, dword [ebp - 0x820]
mov dword [esp], eax
call dword [0x631e3aa8]
mov eax, dword [ebp - 0x81c]
mov dword [esp], eax
call dword [0x631e3ac4]
xor eax, eax
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
add esp, 0x84c
mov eax, ecx
not eax
pop ebx
dec eax
pop esi
pop edi
pop ebp
ret
Function at 0x630a7560
Capabilities:
Enumerate pe sections

Disassembly:
push esi
push ebx
mov edx, dword [esp + 0xc]
mov ebx, dword [esp + 0x10]
add edx, dword [edx + 0x3c]
movzx esi, word [edx + 6]
movzx eax, word [edx + 0x14]
test esi, esi
lea eax, [edx + eax + 0x18]
je 0x630a7598
xor ecx, ecx
nop
mov edx, dword [eax + 0xc]
cmp edx, ebx
ja 0x630a758e
add edx, dword [eax + 8]
cmp ebx, edx
jb 0x630a759a
add ecx, 1
add eax, 0x28
cmp ecx, esi
jne 0x630a7580
xor eax, eax
pop ebx
pop esi
ret
Function at 0x401ee2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x411280]
jne 0x401eec
repz ret
jmp fcn.00404369

Function at 0x4025e7
Capabilities:
Accept command line arguments
Parse pe header

Disassembly:
push 0x14
push 0x40f530
call fcn.00403770
mov eax, 0x5a4d
cmp word [0x400000], ax
jne 0x4024e7
mov eax, dword [0x40003c]
cmp dword [eax + 0x400000], 0x4550
jne 0x4024e7
mov ecx, 0x10b
cmp word [eax + 0x400018], cx
jne 0x4024e7
cmp dword [eax + 0x400074], 0xe
jbe 0x4024e7
xor ecx, ecx
cmp dword [eax + 0x4000e8], ecx
setne cl
mov dword [ebp - 0x1c], ecx
jmp 0x4024eb
and dword [ebp - 0x1c], 0
push 1
call fcn.0040cffb
pop ecx
test eax, eax
jne 0x4024ff
push 0x1c
call fcn.0040cffb
pop ecx
call fcn.00405287
test eax, eax
jne 0x402510
push 0x10
call fcn.0040cffb
pop ecx
call fcn.00405952
and dword [ebp - 4], 0
call fcn.004032ff
test eax, eax
jge 0x40252a
push 0x1b
call fcn.0040cffb
pop ecx
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov dword [0x412ba0], eax
call fcn.0040cffb
mov dword [0x41203c], eax
call fcn.0040cffb
test eax, eax
jge 0x402550
push 8
call fcn.0040cffb
pop ecx
call fcn.00405fde
test eax, eax
jge 0x402561
push 9
call fcn.0040cffb
pop ecx
push 1
call fcn.0040cffb
pop ecx
test eax, eax
je 0x402574
push eax
call fcn.0040cffb
pop ecx
mov eax, dword [0x412018]
mov dword [0x41201c], eax
push eax
push dword [0x412010]
push dword [0x41200c]
call main
add esp, 0xc
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x1c], 0
jne 0x4025a2
push eax
call fcn.0040cffb
call fcn.00402400
jmp 0x4025d7
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [ebp - 0x20]
call fcn.004037b5
ret
call fcn.0040cffb
jmp 0x402495
Function at 0x40595e
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
pushal
call 0x40596d
pop dword [ebp - 0x20]
mov eax, 0xf5898b91
sub eax, 0xf5493224
sub dword [ebp - 0x20], eax
mov dword [ebp - 0x30], 0x49534dbb
sub dword [ebp - 0x30], 0xfb010870
mov dword [ebp - 0x2c], 0xcf283c74
add dword [ebp - 0x2c], 0x630b0fd1
mov dword [ebp - 0x28], 0xfdddd903
sub dword [ebp - 0x28], 0xb19194d5
mov dword [ebp - 0x24], 0x4575e6d7
add dword [ebp - 0x24], 0xba8a1929
lea eax, [ebp - 0x30]
push eax
mov eax, 0xe9f0f6de
add eax, 0x164f7982
add eax, dword [ebp - 0x20]
call dword [eax]
mov dword [ebp - 0x30], 0xd3ca6a82
sub dword [ebp - 0x30], 0x5f58012c
mov dword [ebp - 0x2c], 0xe59f8112
sub dword [ebp - 0x2c], 0xa4331f9d
mov dword [ebp - 0x28], 0xd6978ea3
add dword [ebp - 0x28], 0x8cd7ddc9
mov dword [ebp - 0x24], 0x8067573f
add dword [ebp - 0x24], 0x7f98a8c1
lea ebx, [ebp - 0x30]
push ebx
push eax
mov eax, 0xd091ddef
add eax, 0x2fae9311
add eax, dword [ebp - 0x20]
call dword [eax]
push 0x40
push 0x1000
push 0x3c673
push 0
call eax
mov ecx, 0x7a1d977d
sub ecx, 0x7a1d38be
xor edx, edx
add edx, eax
mov edi, 0xc37acc92
add edi, 0x3cc6336e
add edi, dword [ebp - 0x20]
mov esi, 0xb0045a6
xor dword [ebp - 0x14], ecx
mov ebx, dword [edi]
add dword [ebp - 4], 0x93b69370
xor ebx, esi
sub dword [ebp - 4], edx
mov dword [edx], ebx
add dword [ebp - 8], 0xd88216fa
add edx, 4
add edi, 0x7226533c
sub edi, 0x72265338
loop 0x405a8b
add eax, 0x16dcf
mov ebx, eax
add eax, 0x8d08e1e1
add eax, 0x72f71e24
mov ecx, 0x432d5e15
sub ecx, 0x42ed5e15
add ecx, dword [ebp - 0x20]
call ebx
leave
ret

Function at 0x4065b0
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x40c17c]
jne 0x4065ba
repz ret
jmp fcn.00406941
Function at 0x407010
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
push ebx
push esi
push edi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
movzx ebx, word [ecx + 6]
add eax, 0x18
add eax, ecx
test ebx, ebx
je 0x40704e
mov edi, dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
cmp edi, esi
jb 0x407046
mov ecx, dword [eax + 8]
add ecx, esi
cmp edi, ecx
jb 0x407050
inc edx
add eax, 0x28
cmp edx, ebx
jb 0x407036
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x407120
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
mov eax, 0x5a4d
cmp word [ecx], ax
jne 0x407151
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x407151
mov ecx, 0x10b
cmp word [eax + 0x18], cx
jne 0x407151
mov eax, 1
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x961440
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.00961590
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, pe_nt_image_headers32
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x961466
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x961452
add dl, dl
jne 0x961471
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x9614c4
xor eax, eax
add dl, dl
jne 0x96147e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x961565
add dl, dl
jne 0x96148d
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x961498
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x9614a3
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x9614ae
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x9614ba
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x96145d
mov eax, 1
add dl, dl
jne 0x9614d2
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x9614dd
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x9614c9
sub eax, ebx
mov ebx, 1
jne 0x961510
mov ecx, 1
add dl, dl
jne 0x9614f6
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x961501
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x9614ed
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x96145d
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x961527
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x961532
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x96151e
cmp eax, 0x7d00
jae 0x961555
cmp eax, 0x500
jb 0x961550
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x96145d
cmp eax, 0x7f
ja 0x961558
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x96145d
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x961586
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x96145d
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x431000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40915c
nop
nop
mov ecx, 0x1f634b15
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x43104e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x431024
nop
mov eax, section..data
nop
mov ebx, 0x42f3f8
nop
nop
mov ecx, 0x1fe37314
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x431084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
jne 0x43106c
nop
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x401219
Function at 0x100cefd0
Capabilities:
Packed with generic packer

Disassembly:
cmp byte [esp + 8], 1
jne 0x100cf1b4
pushal
mov esi, section.UPX1
lea edi, [esi - 0x1d000]
push edi
jmp 0x100ceffa
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x100cf001
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x100ceff0
mov eax, 1
add ebx, ebx
jne 0x100cf013
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x100cf024
jne 0x100cf043
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x100cf043
dec eax
add ebx, ebx
jne 0x100cf030
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x100cf008
add ebx, ebx
jne 0x100cf03f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x100cf095
xor ecx, ecx
sub eax, 3
jb 0x100cf05b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x100cf0ca
sar eax, 1
mov ebp, eax
jmp 0x100cf066
add ebx, ebx
jne 0x100cf066
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x100cf034
inc ecx
add ebx, ebx
jne 0x100cf074
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x100cf034
add ebx, ebx
jne 0x100cf081
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x100cf076
jne 0x100cf092
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x100cf076
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x100cf0b4
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x100cf0a6
jmp 0x100ceff6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x100cf0b4
add edi, ecx
jmp 0x100ceff6
pop esi
mov edi, esi
mov ecx, 0x4df
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x100cf0d2
cmp byte [edi], 4
jne 0x100cf0d2
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x100cf0d7
lea edi, [esi + 0xcc000]
mov eax, dword [edi]
or eax, eax
je 0x100cf146
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xcf29c]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xcf2ec]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x100cf104
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xcf2f0]
or eax, eax
je 0x100cf140
mov dword [ebx], eax
add ebx, 4
jmp 0x100cf121
popal
xor eax, eax
ret 0xc
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x100cf177
cmp al, 0xef
ja 0x100cf16a
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x100cf14c
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x100cf159
mov ebp, dword [esi + 0xcf2f4]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x217]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x100cf1ab
sub esp, 0xffffff80
jmp 0x100156b0