joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5fbaec
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff4
mov ebx, eax
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax]
dec al
je 0x5fbb1d
dec al
je 0x5fbb58
dec al
je 0x5fbb9c
dec al
je 0x5fbc0e
jmp 0x5fbca9
mov esi, dword [ebx + 0x24]
inc esi
mov edi, dword [ebx + 0x20]
sub edi, esi
jb 0x5fbca9
inc edi
mov edx, esi
sub edx, dword [ebx + 0x24]
movzx ecx, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx edx, byte [ecx + edx]
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
add dl, byte [eax + esi]
and dl, 0xff
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x5fbb2d
jmp 0x5fbca9
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x5fbca9
mov esi, 1
movzx eax, byte [ebx + 0x48]
mov edx, eax
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
movzx edx, byte [edx + esi]
movzx ecx, al
mov ecx, dword [ebx + ecx*4 + 0x40]
add dl, byte [ecx + esi]
and dl, 0xff
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x5fbb68
jmp 0x5fbca9
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x5fbca9
mov esi, 1
movzx eax, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov edx, dword [ebx + 0x24]
mov ecx, esi
dec ecx
cmp edx, ecx
jbe 0x5fbbcf
xor edx, edx
mov dword [esp + 4], edx
jmp 0x5fbbe4
mov edx, esi
sub edx, dword [ebx + 0x24]
movzx ecx, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx edx, byte [ecx + edx]
mov dword [esp + 4], edx
movzx edx, byte [ebx + 0x48]
mov ebp, dword [ebx + edx*4 + 0x40]
movzx edx, byte [ebp + esi]
add eax, dword [esp + 4]
sar eax, 1
jns 0x5fbbfc
adc eax, 0
add dl, al
and dl, 0xff
mov byte [ebp + esi], dl
inc esi
dec edi
jne 0x5fbbac
jmp 0x5fbca9
xor eax, eax
mov dword [esp + 4], eax
xor eax, eax
mov dword [esp + 8], eax
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x5fbca9
mov esi, 1
movzx eax, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov edx, dword [ebx + 0x24]
mov ecx, esi
dec ecx
cmp edx, ecx
ja 0x5fbc75
mov edx, esi
sub edx, dword [ebx + 0x24]
movzx ecx, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx edx, byte [ecx + edx]
mov dword [esp + 4], edx
movzx edx, byte [ebx + 0x48]
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
mov ecx, esi
sub ecx, dword [ebx + 0x24]
movzx edx, byte [edx + ecx]
mov dword [esp + 8], edx
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx edx, byte [edx + esi]
mov dword [esp], edx
movzx ecx, byte [esp + 8]
push eax
movzx eax, byte [esp + 8]
pop edx
call fcn.005f8a28
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
add al, byte [esp]
and al, 0xff
mov byte [edx + esi], al
inc esi
dec edi
jne 0x5fbc2a
add esp, 0xc
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x637e04
Capabilities:
Get hostname

Disassembly:
push ebx
add esp, 0xffffffdc
mov ebx, eax
mov eax, ebx
call fcn.0040acec
mov dword [esp], 0xf
push esp
lea eax, [esp + 8]
push eax
call sub.kernel32.dll_GetComputerNameW
test eax, eax
je 0x637e35
lea edx, [esp + 4]
mov eax, ebx
mov ecx, dword [esp]
call fcn.0040ae84
add esp, 0x24
pop ebx
ret

Function at 0x66ef00
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
push esi
mov esi, edx
mov ebx, eax
mov eax, esi
mov edx, dword [0x66d230]
call fcn.0040917c
test al, al
je 0x66f019
mov edx, dword [ebx + 0xc]
mov eax, dword [esi + 0xc]
mov ecx, dword [eax]
call dword [ecx + 8]
mov edx, dword [ebx + 0x54]
mov eax, dword [esi + 0x54]
mov ecx, dword [eax]
call dword [ecx + 8]
lea eax, [esi + 8]
mov edx, dword [ebx + 8]
call fcn.0040b0dc
lea eax, [esi + 0x10]
mov edx, dword [ebx + 0x10]
call fcn.0040b0dc
lea eax, [esi + 0x14]
mov edx, dword [ebx + 0x14]
call fcn.0040b0dc
lea eax, [esi + 0x18]
mov edx, dword [ebx + 0x18]
call fcn.0040b0dc
lea eax, [esi + 0x1c]
mov edx, dword [ebx + 0x1c]
call fcn.0040b0dc
lea eax, [esi + 0x20]
mov edx, dword [ebx + 0x20]
call fcn.0040b0dc
lea eax, [esi + 0x4c]
mov edx, dword [ebx + 0x4c]
call fcn.0040b0dc
lea eax, [esi + 0x50]
mov edx, dword [ebx + 0x50]
call fcn.0040b0dc
mov eax, dword [ebx + 0x28]
mov dword [esi + 0x28], eax
mov eax, dword [ebx + 0x2c]
mov dword [esi + 0x2c], eax
mov eax, dword [ebx + 0x30]
mov dword [esi + 0x30], eax
mov eax, dword [ebx + 0x34]
mov dword [esi + 0x34], eax
mov eax, dword [ebx + 0x38]
mov dword [esi + 0x38], eax
mov eax, dword [ebx + 0x3c]
mov dword [esi + 0x3c], eax
mov eax, dword [ebx + 0x40]
mov dword [esi + 0x40], eax
mov eax, dword [ebx + 0x44]
mov dword [esi + 0x44], eax
lea eax, [esi + 0x48]
mov edx, dword [ebx + 0x48]
call fcn.0040b0dc
mov eax, dword [ebx + 0x58]
mov dword [esi + 0x58], eax
mov eax, dword [ebx + 0x5c]
mov dword [esi + 0x5c], eax
lea eax, [esi + 0x68]
mov edx, dword [ebx + 0x68]
call fcn.0040b0dc
mov eax, dword [ebx + 0x60]
mov dword [esi + 0x60], eax
mov eax, dword [ebx + 0x64]
mov dword [esi + 0x64], eax
mov eax, dword [ebx + 0x70]
mov dword [esi + 0x70], eax
mov eax, dword [ebx + 0x74]
mov dword [esi + 0x74], eax
lea eax, [esi + 0x78]
mov edx, dword [ebx + 0x78]
call fcn.0040b0dc
movzx eax, byte [ebx + 0x7c]
mov byte [esi + 0x7c], al
lea eax, [esi + 0x80]
mov edx, dword [ebx + 0x80]
call fcn.0040b0dc
pop esi
pop ebx
ret
mov edx, esi
mov eax, ebx
call fcn.004b8640
pop esi
pop ebx
ret
Function at 0x67ab54
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
mov ecx, 6
push 0
push 0
dec ecx
jne 0x67ab5c
push ecx
push ebx
push esi
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x67ad0b
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebx + 4]
mov eax, dword [eax + 0x18]
mov ecx, dword [eax + 0xc]
lea eax, [ebp - 4]
mov edx, 0x67ad24
call fcn.0040ba24
push esi
mov eax, dword [ebp - 4]
mov dword [ebp - 0x14], eax
mov byte [ebp - 0x10], 0x11
mov eax, dword [ebx + 0x2c]
push eax
lea eax, [ebp - 0x18]
push eax
movzx ecx, word [ebx + 0x30]
mov eax, dword [ebx + 0x1c]
xor edx, edx
call fcn.00678724
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0xc], eax
mov byte [ebp - 8], 0x11
lea edx, [ebp - 0x14]
mov ecx, 1
mov eax, 0x67ad38
call fcn.006069f0
mov eax, dword [ebx + 0xc]
test eax, eax
je 0x67abd5
mov eax, dword [eax - 4]
test eax, eax
jle 0x67ac16
lea eax, [ebp - 0x1c]
push eax
mov eax, dword [ebx + 0x2c]
push eax
lea eax, [ebp - 0x28]
push eax
movzx ecx, word [ebx + 0x30]
mov eax, dword [ebx + 0xc]
xor edx, edx
call fcn.00678724
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0x11
lea edx, [ebp - 0x24]
xor ecx, ecx
mov eax, 0x67ada0
call fcn.006069f0
mov edx, dword [ebp - 0x1c]
mov eax, esi
call fcn.0040b9cc
mov eax, esi
mov edx, 0x67adcc
call fcn.0040b9cc
mov eax, dword [ebx + 0x14]
test eax, eax
je 0x67ac2c
mov eax, dword [eax - 4]
test eax, eax
jle 0x67ac98
lea eax, [ebp - 0x2c]
push eax
mov eax, dword [ebx + 0x14]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0x11
lea edx, [ebp - 0x24]
xor ecx, ecx
mov eax, 0x67ade0
call fcn.006069f0
mov edx, dword [ebp - 0x2c]
mov eax, esi
call fcn.0040b9cc
mov eax, dword [ebx + 0x10]
test eax, eax
je 0x67ac61
mov eax, dword [eax - 4]
test eax, eax
jle 0x67ac8c
lea eax, [ebp - 0x30]
push eax
mov eax, dword [ebx + 0x10]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0x11
lea edx, [ebp - 0x24]
xor ecx, ecx
mov eax, 0x67ae10
call fcn.006069f0
mov edx, dword [ebp - 0x30]
mov eax, esi
call fcn.0040b9cc
mov eax, esi
mov edx, 0x67adcc
call fcn.0040b9cc
mov eax, dword [ebx + 0x18]
test eax, eax
je 0x67aca2
mov eax, dword [eax - 4]
test eax, eax
jle 0x67accd
lea eax, [ebp - 0x34]
push eax
mov eax, dword [ebx + 0x18]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0x11
lea edx, [ebp - 0x24]
xor ecx, ecx
mov eax, 0x67ae3c
call fcn.006069f0
mov edx, dword [ebp - 0x34]
mov eax, esi
call fcn.0040b9cc
mov eax, esi
mov edx, 0x67adcc
call fcn.0040b9cc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x67ad12
lea eax, [ebp - 0x34]
mov edx, 4
call fcn.0040ad4c
lea eax, [ebp - 0x1c]
mov edx, 2
call fcn.0040ad4c
lea eax, [ebp - 4]
call fcn.0040acec
pop eax
jmp eax
Function at 0x68c534
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
mov word [ebp - 0xa], cx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040ade0
mov eax, dword [ebp - 8]
call fcn.0040ade0
xor eax, eax
push ebp
push 0x68c63a
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x4938cc]
call fcn.00408e64
mov dword [ebp - 0x10], eax
mov dl, 1
mov eax, dword [0x4938cc]
call fcn.00408e64
mov dword [ebp - 0x14], eax
xor eax, eax
push ebp
push 0x68c616
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0x10]
call fcn.004be8bc
push 0
push 0
mov eax, dword [ebp - 0x10]
call fcn.004bc444
mov eax, dword [ebp - 0x10]
mov edx, dword [eax]
call dword [edx + 0xc]
mov ebx, eax
dec ebx
test ebx, ebx
jl 0x68c5eb
inc ebx
xor esi, esi
lea edx, [ebp - 0x15]
mov ecx, 1
mov eax, dword [ebp - 0x10]
mov edi, dword [eax]
call dword [edi + 0x18]
mov ecx, esi
movzx eax, word [ebp - 0xa]
shr eax, cl
not al
xor byte [ebp - 0x15], al
lea edx, [ebp - 0x15]
mov ecx, 1
mov eax, dword [ebp - 0x14]
mov edi, dword [eax]
call dword [edi + 0x1c]
inc esi
dec ebx
jne 0x68c5ba
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0x14]
call fcn.004be7d0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x68c61d
mov eax, dword [ebp - 0x10]
call fcn.00408e94
mov eax, dword [ebp - 0x14]
call fcn.00408e94
pop eax
jmp eax
Function at 0x1092b64c
Capabilities:
Encrypt data using rc4 prga

Disassembly:
jb 0x103af691
push esi
movzx esi, cl
btc edx, 0xa9
adc eax, 0x7cf459c2
mov eax, 0x6c16c16d
mul esi
shld ax, cx, 0xd8
mov eax, esi
cmc
sub eax, edx
btc si, di
and esi, esi
shr eax, 1
bsr si, di
add eax, edx
shr eax, 5
and dh, 0x4e
bswap si
movzx eax, al
bsr si, ax
mov esi, ebp
mov edx, eax
add esi, 0x73ec5272
bsf si, dx
pop esi
add cl, 0xd3
cmp esi, esi
test esp, 0x36351a06
sub eax, 1
jne 0x103af677
mov dword [edi + 8], edx
test cl, 0xae
mov dword [edi + 4], 0
cmc
cmp cl, 9
jb 0x103fe44a
movzx edx, cl
mov eax, 0x38e38e39
stc
mul edx
xor ax, 0x7d95
shr edx, 1
rcr ah, cl
ror eax, cl
bts ax, ax
movzx eax, dl
cmp edx, ebp
rcl dx, 0x25
rcr dh, 0x1a
mov edx, eax
cmp bp, 0x7446
lea ecx, [ecx]
clc
test ecx, ebx
add cl, 0xf7
test dx, 0x6ae4
stc
sub eax, 1
jmp 0x103fe441
jne 0x103af6d4
mov dword [edi + 4], edx
movzx eax, cl
mov dword [edi], eax
xor eax, eax
ret
mov dword [edi + 8], 0
cmp cl, 0x2d
jmp 0x103af626
jb 0x108aa15f
mov eax, 1
jmp 0x1091f1d3
ret
push 0xd10bc2b4
call fcn.104045c7
push 0x2b0ca07
call fcn.107eb5de
mov cl, byte [eax]
cmp cl, 0xe1
jmp 0x108b50de
Function at 0xdab1b0
Capabilities:
Acquire debug privileges

Disassembly:
push ecx
lea eax, [esp]
mov dword [esp], 0
push eax
push 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp]
push 1
push str.SeBackupPrivilege
push ecx
call fcn.00dab140
mov edx, dword [esp + 0xc]
push 1
push str.SeDebugPrivilege
push edx
call fcn.00dab140
mov eax, dword [esp + 0x18]
push 1
push str.SeRestorePrivilege
push eax
call fcn.00dab140
mov ecx, dword [esp + 0x24]
push 1
push str.SeSecurityPrivilege
push ecx
call fcn.00dab140
mov edx, dword [esp + 0x30]
add esp, 0x30
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
pop ecx
ret

Function at 0xdabbfa
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
lea eax, [ebp - 4]
push eax
push 0x20019
xor esi, esi
push esi
push str.CLSIDADB880A6_D8FF_11CF_9377_00AA003B7A11InprocServer32
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0xdabc50
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
mov dword [ebp - 8], 0x104
push esi
push esi
push 0xdbd87c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0xdabc43
inc esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0xdabc52
xor eax, eax
pop esi
leave
ret 4
Function at 0x10016ad
Capabilities:
Delete registry value
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x13c
push ebx
push esi
lea eax, [ebp - 0xc]
push eax
push dword [0x1003014]
xor ebx, ebx
push 0x80000002
xor esi, esi
mov byte [ebp - 1], bl
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne fcn.01001715
push ebx
push ebx
lea eax, [ebp - 0x10]
push eax
push ebx
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x13c]
push eax
push esi
push dword [ebp - 0xc]
mov dword [ebp - 8], 0x12b
call dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
inc esi
cmp eax, ebx
je 0x100171e
cmp eax, 0x6f
je 0x10016d8
cmp eax, 0xea
je 0x10016d8
push dword [ebp - 0xc]
jmp loc.01008518
cmp dword [ebp - 0x10], 1
jne 0x10016d8
push dword [ebp + 0x14]
mov eax, dword [ebp - 8]
push dword [ebp + 0x10]
inc dword [ebp - 8]
push dword [ebp + 0xc]
mov byte [ebp + eax - 0x13c], bl
push dword [ebp + 8]
lea eax, [ebp - 0x13c]
push eax
call fcn.010014cf
test al, al
je 0x10016d8
lea eax, [ebp - 0x13c]
push eax
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
test eax, eax
jmp loc.010081bd

Function at 0x100192e
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1d0
or dword [ebp - 0x34], 0xffffffff
or dword [ebp - 0x20], 0xffffffff
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov eax, dword [esi]
xor ebx, ebx
and byte [ebp - 0x24], bl
and byte [ebp - 1], bl
push edi
mov dword [0x100302c], eax
lea eax, [ebp - 0x1d0]
xor edi, edi
push eax
inc edi
push 0x101
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0x40], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x2c], edi
call dword [sym.imp.WS2_32.dll_WSAStartup]
cmp eax, 0xffffffff
jne 0x10019ab
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push dword [0x100302c]
push 0x2716
push 2
call fcn.01001268
add esp, 0x10
push edi
jmp 0x1001d5d
call dword [sym.imp.KERNEL32.dll_GetVersion]
test eax, eax
jns 0x10019c7
jmp loc.01008431
mov dword [0x100300c], ebx
jmp loc.01008545

Function at 0x1001ea7
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14c
push ebx
push esi
push edi
lea eax, [ebp - 0xc]
push eax
push dword [0x1003014]
xor ebx, ebx
push 0x80000002
xor edi, edi
mov byte [ebp - 2], bl
mov byte [ebp - 1], bl
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
mov esi, eax
cmp esi, ebx
jne fcn.01001f18
push ebx
push ebx
lea eax, [ebp - 0x20]
push eax
push ebx
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x14c]
push eax
push edi
push dword [ebp - 0xc]
mov dword [ebp - 8], 0x12b
call dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
mov esi, eax
inc edi
cmp esi, ebx
je 0x1001f39
cmp esi, 0x6f
je 0x1001ed8
cmp esi, 0xea
je 0x1001ed8
push dword [ebp - 0xc]
jmp loc.01008b8a
cmp dword [ebp - 0x20], 1
jne 0x1001ed8
mov eax, dword [ebp - 8]
inc dword [ebp - 8]
mov byte [ebp + eax - 0x14c], bl
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x14c]
push eax
jmp loc.0100909b
Function at 0x10027e8
Capabilities:
Resolve dns

Disassembly:
push dword [esp + 4]
call dword [sym.imp.WS2_32.dll_inet_addr]
cmp eax, 0xffffffff
jne 0x1002811
push dword [esp + 4]
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
je 0x100280e
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov eax, dword [eax]
jmp 0x1002811
or eax, 0xffffffff
ret 4
Function at 0x4061b8
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
push 0
push 0
push 0
cld
call dword [sym.imp.KERNEL32.dll_GetShortPathNameW]
sub eax, 3
mov edx, dword [ecx]
imul eax, edx
movzx eax, al
cmp eax, 0x7c
je 0x40621f
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x24]
push eax
lea eax, [esp + 0x44]
push eax
lea eax, [esp + 0x34]
push eax
push 1
call dword [sym.imp.KERNEL32.dll_GetProcessTimes]
cmp eax, dword [edx + ebp]
je 0x40625f
mov eax, 0x40621a
lea eax, [edx + eax]
push ebp
push eax
push 0
call 0x406259
test eax, eax
jne 0x406238
jmp 0x40625f
push ecx
retf
cmc
nop
mov eax, esp
lea eax, [eax + 8]
mov ecx, eax
or eax, dword [ecx]
and eax, dword [ecx]
cld
or eax, 7
xchg dword [esp + 0xc], edx
lea eax, es:[eax + 0x78968f]
lea eax, [eax - 0x783648]
sub edx, 0x1b4
add dword [edx], eax
mov ecx, dword [esp]
sub esp, 0xffffffec
sub eax, eax
push cs
pop dx
push dx
je 0x40621c
invalid
jmp dword [sym.imp.KERNEL32.dll_EnumResourceTypesA]
add byte [eax], al
add byte [eax], al
mov es, word [ebx - 0x518c4c65]
cmp edi, dword [ecx]
jns 0x40626c
call dword [edi + 7]
push edi
pop es
xchg ecx, eax
mov cl, ch
mov dword [ecx], ebx
mov byte [eax], 0xc4
add byte [ecx + 0x2100b65e], bh
cmp al, 0x16
add cl, dh
cmpsb byte [esi], byte es:[edi]
add byte [esi + edx*2], cl
add byte [ecx], al
insd dword es:[edi], dx
invalid
Function at 0xcda058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.00cda1a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0xcda07e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xcda06a
add dl, dl
jne 0xcda089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xcda0dc
xor eax, eax
add dl, dl
jne 0xcda096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xcda17d
add dl, dl
jne 0xcda0a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xcda0b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xcda0bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xcda0c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0xcda0d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0xcda075
mov eax, 1
add dl, dl
jne 0xcda0ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xcda0f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xcda0e1
sub eax, ebx
mov ebx, 1
jne 0xcda128
mov ecx, 1
add dl, dl
jne 0xcda10e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xcda119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xcda105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xcda075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0xcda13f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xcda14a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xcda136
cmp eax, 0x7d00
jae 0xcda16d
cmp eax, 0x500
jb 0xcda168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xcda075
cmp eax, 0x7f
ja 0xcda170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xcda075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0xcda19e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0xcda075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x431006
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
mov eax, section..3ean
nop
nop
nop
nop
nop
push 4
pop edi
nop
nop
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
je 0x431072
nop
nop
mov ebx, 0x40915c
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x69b16c26
nop
nop
nop
nop
xor dword [eax], esi
add eax, edi
nop
nop
nop
nop
nop
loop 0x431060
nop
nop
nop
nop
mov eax, section..7LWLf
cmp eax, 0
nop
nop
nop
nop
nop
nop
nop
je 0x4310d2
mov ebx, 0x42f3f8
nop
nop
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x2c4426f
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x4310c0
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x401219
Function at 0x43b64d
Capabilities:
Encode data using xor

Disassembly:
mov edi, 0x43b3c1
sub esi, ebx
call fcn.0043b681
mov esi, esi
add esi, ebx
xor dword [edx], edi
mov ebx, ebx
inc edx
push esi
mov esi, dword [esp]
add esp, 4
or ebx, ebx
sub esp, 4
mov dword [esp], ebx
mov ebx, dword [esp]
add esp, 4
cmp edx, eax
jne fcn.0043b64d
sub ebx, esi
inc esi
ret

Function at 0x4515f0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x3b000]
push edi
or ebp, 0xffffffff
jmp 0x451612
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x451619
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x451608
mov eax, 1
add ebx, ebx
jne 0x45162b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x451620
jne 0x45163c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x451620
xor ecx, ecx
sub eax, 3
jb 0x451650
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x4516c2
mov ebp, eax
add ebx, ebx
jne 0x45165b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x451668
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x45168c
inc ecx
add ebx, ebx
jne 0x451678
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x45166d
jne 0x451689
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x45166d
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x4516ac
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x45169d
jmp 0x45160e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x4516ac
add edi, ecx
jmp 0x45160e
pop esi
mov edi, esi
mov ecx, 6
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x4516ca
cmp byte [edi], 0x32
jne 0x4516ca
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x4516cf
lea edi, [esi + 0x4f000]
mov eax, dword [edi]
or eax, eax
je 0x451747
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x51a80]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x51abc]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x4516fc
mov ecx, edi
jns 0x45172b
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x51ac0]
or eax, eax
je 0x451741
mov dword [ebx], eax
add ebx, 4
jmp 0x451719
call dword [esi + 0x51ad0]
mov ebp, dword [esi + 0x51ac4]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1cf]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x45177b
sub esp, 0xffffff80
jmp 0x401094