joyce8/EMBER2024-capa huggingface dataset:
Function at 0x410010
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, dword [0x542698]
push edi
mov edi, dword [ebp + 0x10]
mov dword [ebp - 8], edx
mov ebx, dword [esi + 0x3e78]
mov dword [ebp - 0xc], ecx
mov eax, dword [ebx + 0xc]
movss xmm3, dword [ebx + 0x228]
and eax, 4
movss xmm4, dword [ebx + 0x22c]
or eax, 0x1000103
or edi, eax
cmp dword [ebx + 0x190], 0
mov dword [ebp + 0x10], edi
mov eax, ebx
jne 0x410062
cmp dword [esi + 0x4a34], 0
je 0x41006a
movss xmm3, dword [ebx + 0x1f8]
mov ecx, dword [ebp + 8]
xorps xmm5, xmm5
subss xmm3, dword [eax + 0xf0]
subss xmm4, dword [eax + 0xf4]
movss xmm2, dword [0x53f7b4]
cvttss2si eax, dword [ecx]
mov dword [ebp + 8], 0
mov dword [ebp - 4], 2
movd xmm1, eax
cvttss2si eax, dword [ecx + 4]
cvtdq2ps xmm1, xmm1
movd xmm0, eax
ucomiss xmm1, xmm5
cvtdq2ps xmm0, xmm0
lahf
xor ecx, ecx
test ah, 0x44
mov eax, 1
cmovnp ecx, eax
ucomiss xmm0, xmm5
lahf
test ah, 0x44
mov eax, dword [ebp + 8]
cmovnp eax, dword [ebp - 4]
or eax, ecx
comiss xmm5, xmm1
mov dword [ebp + 8], eax
jb 0x4100e2
addss xmm1, xmm3
comiss xmm1, xmm2
jae 0x4100e2
movaps xmm1, xmm2
comiss xmm5, xmm0
jb 0x4100f3
addss xmm0, xmm4
comiss xmm0, xmm2
jae 0x4100f3
movaps xmm0, xmm2
or dword [esi + 0x472c], 2
mov ecx, dword [ebp - 0xc]
movss dword [esi + 0x474c], xmm1
movss dword [esi + 0x4750], xmm0
mov dword [esi + 0x4734], 1
mov eax, dword [ebx + 4]
push edx
test ecx, ecx
je 0x410136
push ecx
push eax
push str._s__s__08X
lea eax, [ebp - 4]
push 0
push eax
call fcn.00409d20
add esp, 0x18
jmp 0x41014a
push eax
push str._s__08X
lea eax, [ebp - 4]
push 0
push eax
call fcn.00409d20
add esp, 0x14
cmp byte [ebp + 0xc], 0
movss xmm0, dword [esi + 0x37b0]
movss dword [ebp - 0xc], xmm0
jne 0x410167
mov dword [esi + 0x37b0], 0
mov ecx, dword [ebp - 4]
xor edx, edx
push edi
call fcn.00412a50
mov edi, dword [esi + 0x3e78]
add esp, 4
movss xmm0, dword [ebp - 0xc]
mov edx, dword [ebp - 8]
movss dword [esi + 0x37b0], xmm0
cmp word [edi + 0xb6], 1
mov byte [ebp + 0xf], al
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], edi
mov dword [edi + 0x74], edx
mov byte [edi + 0xc6], al
jne 0x4101b9
mov ecx, dword [edi + 0x14]
mov eax, dword [edi + 0x18]
mov dword [ebx + 0xf0], ecx
mov dword [ebx + 0xf4], eax
mov edi, edx
mov al, 0x23
not edi
mov edx, 0x53e9d1
mov ebx, edi
cmp al, 0x23
jne 0x4101d4
cmp byte [edx], al
jne 0x4101d4
cmp byte [edx + 1], al
cmove ebx, edi
movzx ecx, bl
movzx eax, al
xor ecx, eax
shr ebx, 8
mov al, byte [edx]
inc edx
xor ebx, dword [ecx*4 + 0x53a2c8]
test al, al
jne 0x4101c6
mov edi, dword [ebp - 0xc]
not ebx
cmp dword [esi + 0x3ec4], ebx
jne 0x410203
xor edx, edx
xor ecx, ecx
call fcn.0040ca80
mov eax, dword [ebp - 8]
cmp dword [esi + 0x4808], eax
jne 0x410251
test dword [ebp + 0x10], 0x800000
jne 0x410251
cmp word [edi + 0x14c], 0
jne 0x41022a
cmp byte [edi + 0x152], 0
je 0x410251
xor edx, edx
mov ecx, edi
call fcn.00414ee0
xor dl, dl
mov ecx, edi
call fcn.00419d80
mov edx, edi
mov ecx, ebx
call fcn.0040ca80
mov eax, dword [esi + 0x482c]
mov dword [esi + 0x3ee4], eax
mov al, byte [ebp + 0xf]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4104a0
Capabilities:
Hash data with crc32

Disassembly:
mov eax, dword [0x542698]
push ebx
push esi
push edi
mov esi, dword [eax + 0x3e68]
mov edi, ecx
mov eax, dword [eax + 0x3e60]
lea ebx, [esi + eax*8]
test eax, eax
je 0x41047e
nop dword [eax]
mov edx, eax
shr edx, 1
cmp dword [esi + edx*8], edi
lea ecx, [esi + edx*8]
jae 0x410478
lea esi, [ecx + 8]
or ecx, 0xffffffff
sub ecx, edx
add eax, ecx
jmp 0x41047a
mov eax, edx
test eax, eax
jne 0x410460
cmp esi, ebx
je 0x41048d
cmp dword [esi], edi
jne 0x41048d
mov eax, dword [esi + 4]
pop edi
pop esi
pop ebx
ret
pop edi
pop esi
xor eax, eax
pop ebx
ret
mov eax, ecx
or ecx, 0xffffffff
push ebx
push esi
mov bl, byte [eax]
lea esi, [eax + 1]
test bl, bl
je 0x4104dd
push edi
or edi, 0xffffffff
cmp bl, 0x23
jne 0x4104c3
cmp byte [esi], bl
jne 0x4104c3
cmp byte [esi + 1], bl
cmove ecx, edi
movzx edx, cl
movzx eax, bl
mov bl, byte [esi]
xor edx, eax
shr ecx, 8
inc esi
xor ecx, dword [edx*4 + 0x53a2c8]
test bl, bl
jne 0x4104b4
pop edi
pop esi
not ecx
pop ebx
jmp 0x410440
Function at 0x41cce0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ebx
push esi
push edi
mov edi, ecx
mov ebx, edx
cmp dword [edi + 0x5af0], 0
lea esi, [edi + 0x5af4]
je 0x41cd62
mov ecx, dword [esi + 4]
test ecx, ecx
jns 0x41cd1c
mov eax, ecx
cdq
sub eax, edx
sar eax, 1
add eax, ecx
xor ecx, ecx
test eax, eax
cmovg ecx, eax
push ecx
mov ecx, esi
call fcn.0041ec00
push dword [ebp + 8]
mov ecx, esi
mov dword [esi], 0
push ebx
call fcn.0040a210
mov edx, dword [esi]
mov ecx, 0x5426a0
push dword [edi + 0x5af0]
lea eax, [edx - 1]
neg edx
sbb edx, edx
and edx, eax
mov eax, dword [edi + 0x5afc]
test eax, eax
push edx
cmovne ecx, eax
push 1
push ecx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push dword [ebp + 8]
mov ecx, esi
push ebx
call fcn.0040a210
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x41d160
Capabilities:
Hash data with crc32

Disassembly:
push ebx
mov bl, byte [ecx]
or eax, 0xffffffff
push esi
lea esi, [ecx + 1]
push edi
mov edi, dword [0x542698]
test bl, bl
je 0x41d1a6
or edi, 0xffffffff
cmp bl, 0x23
jne 0x41d187
cmp byte [esi], bl
jne 0x41d187
cmp byte [esi + 1], bl
cmove eax, edi
movzx edx, al
movzx ecx, bl
mov bl, byte [esi]
xor edx, ecx
shr eax, 8
inc esi
xor eax, dword [edx*4 + 0x53a2c8]
test bl, bl
jne 0x41d178
mov edi, dword [0x542698]
mov esi, dword [edi + 0x5a94]
xor ecx, ecx
not eax
test esi, esi
jle 0x41d1cc
mov edi, dword [edi + 0x5a9c]
lea edx, [edi + 4]
nop dword [eax]
cmp dword [edx], eax
je 0x41d1d2
inc ecx
add edx, 0x24
cmp ecx, esi
jl 0x41d1c0
pop edi
pop esi
xor eax, eax
pop ebx
ret
lea eax, [ecx + ecx*8]
lea eax, [edi + eax*4]
pop edi
pop esi
pop ebx
ret
Function at 0x426db0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x426dec
mov eax, dword [0x542698]
mov dword [esi + 4], 0
mov dword [esi], 0
test eax, eax
je 0x426dd6
dec dword [eax + 0xac]
push dword [0x54269c]
push ecx
call fcn.00409220
add esp, 8
mov dword [esi + 8], 0
mov ecx, dword [esi + 0x14]
test ecx, ecx
je 0x426e26
mov eax, dword [0x542698]
mov dword [esi + 0x10], 0
mov dword [esi + 0xc], 0
test eax, eax
je 0x426e10
dec dword [eax + 0xac]
push dword [0x54269c]
push ecx
call fcn.00409220
add esp, 8
mov dword [esi + 0x14], 0
mov ecx, dword [esi + 0x20]
test ecx, ecx
je 0x426e60
mov eax, dword [0x542698]
mov dword [esi + 0x1c], 0
mov dword [esi + 0x18], 0
test eax, eax
je 0x426e4a
dec dword [eax + 0xac]
push dword [0x54269c]
push ecx
call fcn.00409220
add esp, 8
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov ecx, dword [esi + 0x44]
test ecx, ecx
je 0x426eb6
mov eax, dword [0x542698]
mov dword [esi + 0x40], 0
mov dword [esi + 0x3c], 0
test eax, eax
je 0x426ea0
dec dword [eax + 0xac]
push dword [0x54269c]
push ecx
call fcn.00409220
add esp, 8
mov dword [esi + 0x44], 0
mov ecx, dword [esi + 0x50]
test ecx, ecx
je 0x426ef0
mov eax, dword [0x542698]
mov dword [esi + 0x4c], 0
mov dword [esi + 0x48], 0
test eax, eax
je 0x426eda
dec dword [eax + 0xac]
push dword [0x54269c]
push ecx
call fcn.00409220
add esp, 8
mov dword [esi + 0x50], 0
mov ecx, dword [esi + 0x5c]
test ecx, ecx
je 0x426f2a
mov eax, dword [0x542698]
mov dword [esi + 0x58], 0
mov dword [esi + 0x54], 0
test eax, eax
je 0x426f14
dec dword [eax + 0xac]
push dword [0x54269c]
push ecx
call fcn.00409220
add esp, 8
mov dword [esi + 0x5c], 0
lea ecx, [esi + 0x78]
pop esi
jmp fcn.0042a860
Function at 0x433502
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x433541
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x433541
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x433541
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x433541
cmp dword [ecx + 0x74], 0xe
jbe 0x433541
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x1f0a7c9
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg dword [esp + 4], ebx
call fcn.01f0a7b3
sbb dword [ecx + 0x5a9b6809], ebx
or dword [eax - 0x65], ebp
pop edx
jns 0x1f0a7d4
push 0x594cfa0f
fisttp word [edi + 0x2a]
fldenv [edx]
mov dl, 0xad

Function at 0x1f0a7e6
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0xf1ef99bc
jmp 0x1f0a864
push word [esp + 3]
jb 0x1f0a767
push esp
lea esp, [esp + 3]
push dword [esp + 1]
lea esp, [esp + 3]
mov dword [esp + 4], ecx
jmp 0x1f0a852
mov dword [esp + 0x14], esp
mov dword [esp + 0x10], ebp
mov dword [esp + 0xc], esi
push esi
jmp 0x1f0a87a
pushal
pop word [esp + 0xb]
pop dword [esp + 0x11]
mov word [esp + 0xb], bp
lea esp, [esp + 2]
jmp 0x1f0a820
mov dword [esp], edx
push sp
mov byte [esp], cl
mov byte [esp], ah
lea esp, [esp + 2]
push ebx
jmp 0x1f0a836
cpuid
jmp 0x1f0a88d
mov word [esp + 1], si
mov dword [esp + 0xc], edi
lea esp, [esp + 0xc]
pushfd
jmp 0x1f0a4cc
mov bl, 0x62
cpuid
jmp 0x1f0a8aa
mov edi, dword [esp + 0x2c]
rdtsc
stc
jmp 0x1f0aa84
cpuid
lea esi, [esp]
rdtsc
jmp 0x1f0a926
sub esp, 0xbc
jmp 0x1f0a905
push esp
not ebx
jmp 0x1f0a8ea
mov ebp, esp
bsr ecx, esp
jmp 0x1f0a9ab
sub esp, 2
mov bx, 0x90c2
lea esp, [esp + 2]
ror bl, 6
jno 0x1f0a900
push esp
not ebx
jmp 0x1f0a8ea
jbe 0x1f0a910
sub esp, 2
mov bx, 0x90c2
call 0x1f0a930
jno 0x1f0a8b7
cpuid
jmp 0x1f0a8b9

Function at 0x1f0baed
Capabilities:
Execute anti-debugging instructions

Disassembly:
rdtsc
btc dx, di
mov ax, dx
xchg edx, ecx
push dword [esp + 0xc]
ret 0x10
mov ax, cx
lea ebx, [ebx - 0x48]
mov cl, byte [esp]
mov al, 0x71
mov cx, 0xb4f4
xchg dword [esp + 0xc], ebx
jmp 0x1f0b712
lea esp, [esp + 3]
xchg dword [esp + 0xc], ebx
xchg ecx, edx
xchg ah, dh
mov eax, dword [esp]
neg cl
jmp 0x1f0b99c
rdtsc
bsf ecx, ebp
lea ecx, [eax*4]
sub esp, 0x13
pop dword [esp + 9]
jmp 0x1f0ba2c

Function at 0x1f0ef5c
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov eax, dword [esp + 2]
lea esp, [esp]
lea edi, [esp + 4]
rdtsc
call fcn.01f0ef46
Function at 0x1f10e57
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov ecx, 0xd5f02238
sub esp, 8
mov ax, word [esp + 2]
call fcn.01f10eb1
xchg byte [ecx], dh
xor byte [ebx], dh

Function at 0x202b251
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea ebx, [edi + ebp]
mov ebx, dword [esp]
push edx
lea esp, [esp + 1]
mov dword [esp], ebx
jmp 0x202b23b

Function at 0x202b76a
Capabilities:
Execute anti-debugging instructions

Disassembly:
rcr edx, 0x1d
rcr bl, 7
rol ebx, cl
jmp 0x202b7d0
pop dx
mov byte [esp + 7], al
neg dl
mov dl, ah
inc edx
mov al, 0xbe
jmp 0x202b7fb
mov edx, 0xf32f912
xchg al, dl
add esp, 1
bts ax, si
jmp 0x202b7e2
bsr ebx, esp
pop ebx
setle bh
mov ebx, dword [esp + 4]
bsr bx, bx
stc
jmp 0x202b7a9
lea eax, [eax*4]
mov dx, 0xabfa
mov word [esp], di
bswap edx
jmp 0x202b80c
or ah, dh
mov ax, si
setg bh
mov al, 0xe
ror bh, cl
pop dword [esp]
jmp 0x202b7b8
neg ax
bswap eax
rcl bl, 4
mov word [esp + 1], dx
or bx, ax
xchg dword [esp], ebx
jmp 0x202ba17
mov dl, byte [esp]
lea ebx, [ebx*4]
rol dh, 0
std
jmp 0x202b88e
sub edx, 0x69bedf68
setl al
rdtsc
rdtsc
rol bx, 8
xor edx, ecx
jmp 0x202b84d
setae dl
cmc
mov eax, 0x74f37f7c
call fcn.0202b878
not al
mov bx, word [esp]
mov dx, 0x4422
xchg byte [esp], ah
mov bx, word [esp + 1]
jmp 0x202b8dc
neg bx
bswap ebx
cld
cmc
bsr dx, si
mov bx, word [esp]
jmp 0x202b863
mov bl, dl
call fcn.0202b908
cmpsb byte [esi], byte es:[edi]
das
mov edi, 0xccd529da
inc eax
salc
mov cl, 0x40
stosd dword es:[edi], eax
jge 0x202b927
fild word [esi + 0x6601247c]
mov ebx, 0x3489ffd4
and al, 0x8d
and al, 3
xchg byte [esp + 1], bh
mov bx, 0xffd4
mov dword [esp], esi
lea esp, [esp + 3]
bsf ebx, eax
rdtsc
jmp 0x202b8c6
jmp 0x202b95e
xchg dx, bx
xchg ebx, edx
dec bx
lea edx, [esi*4]
mov eax, 0x9e3440e3
clc
jmp 0x202b8b5
xchg ebx, eax
neg ebx
mov edx, dword [esp]
sub esp, 0x1b
setne al
bsr ebx, ebp
jmp 0x202b9e6
xchg byte [esp], dl
mov edx, ecx
pop ax
add esp, 0
bswap eax
add edx, 0xbf23d0c
jmp 0x202b948
cld
not dl
shr dh, cl
mov edx, dword [esp]
mov byte [esp], ah
pop bx
jmp 0x202b92f
push dword [esp + 1]
setg dl
sub esp, 0x14
xchg byte [esp + 0x2e], bl
jmp 0x202b9c1
add esp, 8
mov ebx, dword [esp + 3]
sete ah
lea esp, [esp + 1]
xchg byte [esp + 8], ah
sub esp, 0x14
jmp 0x202b994
mov edx, dword [esp + 0x32]
sub esp, 0xa
lea esp, [esp + 0x49]
inc al
setnp dh
lea eax, [edi*4]
jmp 0x202ba00
add esp, 0
mov ebx, 0x17d7d210
mov dx, 0xef47
sbb dx, 0xe5c9
mov dl, byte [esp + 0x13]
bsf ebx, ebx
jmp 0x202b9aa
setge bl
lea ebx, [edi*4]
mov dl, 0xe1
mov ax, si
rdtsc
jmp 0x202bac3
btc dx, cx
lea esp, [esp + 3]
add esp, 0
lea edx, [ecx*4]
not dl
lea esp, [esp]
jmp 0x202b985
add esp, 0xa
mov ah, byte [esp + 0xc]
mov ebx, 0x9d7ad695
call fcn.0202ba5c
sbb eax, 0xf1467f6c
not bl
mov ebx, dword [esp + 8]
xchg dword [esp + 2], ebx
std
mov byte [esp + 9], ch
rdtsc
jmp 0x202ba33
mov bx, 0x5f4
xchg byte [esp + 1], al
mov eax, 0x71a5303a
clc
lea ebx, [edi + 0xdc]
xchg ah, bh
jmp 0x202ba49
rdtsc
pushal
pop eax
pop ebx
btr edx, eax
dec ax
jmp 0x202ba7f
Function at 0x202b908
Capabilities:
Execute anti-debugging instructions

Disassembly:
neg edx
sub esp, 0x18
setg ah
lea esp, [esp + 0x1f]
mov bh, byte [esp + 1]
jmp 0x202b916
sub esp, 5
mov dl, ch
not eax
mov ebx, dword [esp + 9]
std
jmp 0x202b8f2
btr eax, ebx
rcl ebx, cl
shl ebx, 8
not eax
mov ax, 0xc1fe
seto bl

Function at 0x202c2c7
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov bh, 0xe
xchg ah, dh
lea edx, reloc.KERNEL32.dll_GetConsoleCP
jmp 0x202c017
mov edx, dword [esp]
xchg bh, bl
inc eax
std
rdtsc
clc
jmp 0x202bff5
mov edx, 0x735497dd
mov ah, bh
lea edx, reloc.KERNEL32.dll_GetConsoleCP
bsr ax, si
jmp 0x202c05b
push ecx
mov word [esp + 0xa], bx
bswap ebx
pushal
lea esp, [esp + 0x49]
bsr ebx, esp
jmp 0x202c00b
lea edx, [ebx*4]
not edx
call fcn.0202c045
dec ax
and eax, eax
rdtsc
lea ebx, [ecx + edx]
mov al, 0xfe
not bl
jmp 0x202c033
pop dword [esp + 0xc]
mov word [esp + 0x23], sp
mov byte [esp + 0x1b], ch
pop edx
xchg byte [esp + 0xf], dl
push dx
jmp 0x202c087
mov word [esp + 0x14], bx
std
mov eax, 0x6f1fd979
jmp 0x202c0d8

Function at 0x202c374
Capabilities:
Access peb ldr_data

Disassembly:
mov word [esp + 1], dx
mov dword [esp], esi
lea esp, [esp + 5]
mov byte [esp], dh
pushfd
jmp 0x202c3af
lea esp, [esp + 3]
lea esp, [esp + 1]
push esi
pushfd
push word [esp + 3]
jmp 0x202c35e
lea esp, [esp + 1]
mov dword [esp], edi
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
jmp 0x202c399
Function at 0x41ec40
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x10000]
push edi
jmp 0x41ec5a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x41ec61
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x41ec50
mov eax, 1
add ebx, ebx
jne 0x41ec73
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x41ec68
jne 0x41ec84
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x41ec68
xor ecx, ecx
sub eax, 3
jb 0x41ec98
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x41ed0a
mov ebp, eax
add ebx, ebx
jne 0x41eca3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x41ecb0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x41ecd4
inc ecx
add ebx, ebx
jne 0x41ecc0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x41ecb5
jne 0x41ecd1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x41ecb5
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x41ecf4
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x41ece5
jmp 0x41ec56
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x41ecf4
add edi, ecx
jmp 0x41ec56
pop esi
mov edi, esi
mov ecx, 0x4fc
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x41ed12
cmp byte [edi], 1
jne 0x41ed12
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x41ed17
lea edi, [esi + 0x1c000]
mov eax, dword [edi]
or eax, eax
je 0x41ed8f
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x1e000]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x1e094]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x41ed44
mov ecx, edi
jns 0x41ed73
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x1e09c]
or eax, eax
je 0x41ed89
mov dword [ebx], eax
add ebx, 4
jmp 0x41ed61
call dword [esi + 0x1e098]
mov ebp, dword [esi + 0x1e0a0]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x21f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x41edc3
sub esp, 0xffffff80
jmp section.UPX0
Function at 0x55cfb0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0xe0000]
push edi
jmp 0x55cfca
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x55cfd1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x55cfc0
mov eax, 1
add ebx, ebx
jne 0x55cfe3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x55cff4
jne 0x55d013
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x55d013
dec eax
add ebx, ebx
jne 0x55d000
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x55cfd8
add ebx, ebx
jne 0x55d00f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x55d065
xor ecx, ecx
sub eax, 3
jb 0x55d02b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x55d09a
sar eax, 1
mov ebp, eax
jmp 0x55d036
add ebx, ebx
jne 0x55d036
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x55d004
inc ecx
add ebx, ebx
jne 0x55d044
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x55d004
add ebx, ebx
jne 0x55d051
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x55d046
jne 0x55d062
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x55d046
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x55d084
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x55d076
jmp 0x55cfc6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x55d084
add edi, ecx
jmp 0x55cfc6
pop esi
mov edi, esi
mov ecx, 0x4540
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x55d0a2
cmp byte [edi], 0x26
jne 0x55d0a2
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x55d0a7
lea edi, [esi + 0x159000]
mov eax, dword [edi]
or eax, eax
je 0x55d11f
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x1636f4]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x163820]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x55d0d4
mov ecx, edi
jns 0x55d103
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x163824]
or eax, eax
je 0x55d119
mov dword [ebx], eax
add ebx, 4
jmp 0x55d0f1
call dword [esi + 0x163834]
mov ebp, dword [esi + 0x163828]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x237]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x55d153
sub esp, 0xffffff80
jmp 0x4968a1
Function at 0x40d6e0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, 0x40c015
lea edi, [esi - 0xb015]
push edi
or ebp, 0xffffffff
jmp 0x40d702
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x40d709
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x40d6f8
mov eax, 1
add ebx, ebx
jne 0x40d71b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x40d710
jne 0x40d72c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x40d710
xor ecx, ecx
sub eax, 3
jb 0x40d740
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x40d7b2
mov ebp, eax
add ebx, ebx
jne 0x40d74b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x40d758
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x40d77c
inc ecx
add ebx, ebx
jne 0x40d768
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x40d75d
jne 0x40d779
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x40d75d
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x40d79c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x40d78d
jmp 0x40d6fe
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x40d79c
add edi, ecx
jmp 0x40d6fe
pop esi
mov edi, esi
mov ecx, 0x57
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x40d7ba
cmp byte [edi], 2
jne 0x40d7ba
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x40d7bf
lea edi, [esi + 0xb000]
mov eax, dword [edi]
or eax, eax
je 0x40d82e
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xd4ec]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xd550]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x40d7ec
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xd558]
or eax, eax
je 0x40d828
mov dword [ebx], eax
add ebx, 4
jmp 0x40d809
call dword [esi + 0xd554]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x40d85f
cmp al, 0xef
ja 0x40d852
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x40d834
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x40d841
mov ebp, dword [esi + 0xd55c]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x19f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
lea ebx, [esi - 0x1000]
lea edi, [ebx + 0xd8ba]
push edi
xor eax, eax
stosb byte es:[edi], al
pop ecx
dec ecx
push eax
push 1
push ebx
call ecx
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x40d8ab
sub esp, 0xffffff80
jmp 0x4013f0

Function at 0x410051
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
mov eax, 0x401000
call 0x410051
lcall 0x5de5, 0x8b10c483
jmp loc.0080f700