joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10208620
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x14
call fcn.10054ed0
mov eax, dword [esp + 0x18]
push ebx
push ebp
push esi
movzx ecx, byte [eax + 0xf]
mov esi, dword [esp + 0x28]
mov ebp, ecx
and ecx, 0xf
mov dword [esp + 0x24], 0
add ecx, ecx
and ebp, 0xfffffff0
push edi
mov ebx, dword [esi + ecx*8]
mov edi, dword [esi + ecx*8 + 4]
mov edx, dword [esi + ecx*8 + 8]
mov ecx, dword [esi + ecx*8 + 0xc]
mov esi, edx
shrd edx, ecx, 4
and esi, 0xf
mov dword [esp + 0x14], ebx
or dword [esp + 0x28], edx
shl dword [esp + 0x14], 0x1c
shrd ebx, edi, 4
mov edx, dword [esi*4 + 0x102cf590]
mov esi, dword [esp + 0x2c]
shr ecx, 4
or dword [esp + 0x14], ecx
xor ecx, ecx
shr edi, 4
xor ecx, ebx
xor ecx, dword [esi + ebp]
xor edx, edi
xor edx, dword [esi + ebp + 4]
mov edi, dword [esp + 0x28]
mov ebx, dword [esp + 0x14]
xor edi, dword [esi + ebp + 8]
xor ebx, dword [esi + ebp + 0xc]
mov dword [esp + 0x18], edx
mov edx, 0xe
mov dword [esp + 0x10], ecx
mov dword [esp + 0x1c], edx
nop dword [eax + eax]
movzx edx, byte [edx + eax]
xor esi, esi
mov ebp, dword [esp + 0x10]
mov ecx, edx
shr ecx, 4
and edx, 0xf
mov dword [esp + 0x20], ecx
add edx, edx
mov ecx, edi
shl ebp, 0x1c
shrd edi, ebx, 4
and ecx, 0xf
mov dword [esp + 0x28], 0
shr ebx, 4
or esi, edi
or ebp, ebx
xor edi, edi
mov ebx, dword [ecx*4 + 0x102cf590]
mov ecx, dword [esp + 0x18]
shrd dword [esp + 0x10], ecx, 4
xor edi, dword [esp + 0x10]
shr ecx, 4
xor ebx, ecx
mov ecx, dword [esp + 0x2c]
xor ebx, dword [ecx + edx*8 + 4]
xor ebp, dword [ecx + edx*8 + 0xc]
xor edi, dword [ecx + edx*8]
xor esi, dword [ecx + edx*8 + 8]
mov edx, edi
shrd edi, ebx, 4
mov ecx, esi
shl edx, 0x1c
shrd esi, ebp, 4
and ecx, 0xf
shr ebx, 4
or dword [esp + 0x28], esi
shr ebp, 4
or edx, ebp
xor ebp, ebp
mov ecx, dword [ecx*4 + 0x102cf590]
xor ebp, edi
xor ecx, ebx
mov dword [esp + 0x14], edx
mov edx, dword [esp + 0x20]
mov ebx, ebp
add edx, edx
mov dword [esp + 0x10], ebp
mov ebp, dword [esp + 0x2c]
xor ebx, dword [ebp + edx*8]
xor ecx, dword [ebp + edx*8 + 4]
mov dword [esp + 0x10], ebx
mov ebx, dword [esp + 0x28]
xor ebx, dword [ebp + edx*8 + 8]
mov dword [esp + 0x28], ebx
mov ebx, dword [esp + 0x14]
xor ebx, dword [ebp + edx*8 + 0xc]
mov edx, dword [esp + 0x1c]
mov edi, dword [esp + 0x28]
sub edx, 1
mov dword [esp + 0x18], ecx
mov dword [esp + 0x1c], edx
jns 0x102086c0
mov edx, dword [esp + 0x18]
shr ecx, 0x18
mov byte [eax], cl
mov ecx, edx
shr ecx, 0x10
mov byte [eax + 1], cl
mov ecx, edx
shr ecx, 8
mov byte [eax + 2], cl
mov byte [eax + 3], dl
mov edx, dword [esp + 0x10]
mov ecx, edx
shr ecx, 0x18
mov byte [eax + 4], cl
mov ecx, edx
shr ecx, 0x10
mov byte [eax + 5], cl
mov ecx, edx
shr ecx, 8
mov byte [eax + 6], cl
mov ecx, ebx
shr ecx, 0x18
mov byte [eax + 8], cl
mov ecx, ebx
shr ecx, 0x10
mov byte [eax + 9], cl
mov ecx, ebx
shr ecx, 8
mov byte [eax + 0xa], cl
mov byte [eax + 7], dl
mov edx, edi
mov ecx, edx
mov byte [eax + 0xb], bl
shr ecx, 0x18
mov byte [eax + 0xc], cl
mov ecx, edx
shr ecx, 0x10
pop edi
mov byte [eax + 0xd], cl
mov ecx, edx
pop esi
shr ecx, 8
pop ebp
mov byte [eax + 0xe], cl
mov byte [eax + 0xf], dl
pop ebx
add esp, 0x14
ret
Function at 0x1020b1c0
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Encrypt data using salsa20 or chacha

Disassembly:
mov eax, 0x98
call fcn.10054ed0
mov eax, dword [0x102fb070]
xor eax, esp
mov dword [esp + 0x94], eax
mov ecx, dword [esp + 0xa8]
push edi
mov edi, dword [esp + 0xa0]
mov dword [esp + 4], edi
mov eax, dword [ecx]
mov dword [esp + 0x68], eax
mov eax, dword [ecx + 4]
mov dword [esp + 0x6c], eax
mov eax, dword [ecx + 8]
mov dword [esp + 0x70], eax
mov eax, dword [ecx + 0xc]
mov dword [esp + 0x74], eax
mov eax, dword [ecx + 0x10]
mov dword [esp + 0x78], eax
mov eax, dword [ecx + 0x14]
mov dword [esp + 0x7c], eax
mov eax, dword [ecx + 0x18]
mov dword [esp + 0x80], eax
mov eax, dword [ecx + 0x1c]
mov ecx, dword [esp + 0xb0]
mov dword [esp + 0x84], eax
mov dword [esp + 0x58], 0x61707865
mov dword [esp + 0x5c], 0x3320646e
mov eax, dword [ecx]
mov dword [esp + 0x88], eax
mov eax, dword [ecx + 4]
mov dword [esp + 0x8c], eax
mov eax, dword [ecx + 8]
mov dword [esp + 0x90], eax
mov eax, dword [ecx + 0xc]
mov dword [esp + 0x94], eax
mov eax, dword [esp + 0xa8]
mov dword [esp + 0x60], 0x79622d32
mov dword [esp + 0x64], 0x6b206574
test eax, eax
je 0x1020b3bd
push ebx
mov ebx, dword [esp + 0xa8]
push ebp
push esi
nop
mov esi, 0x40
cmp eax, esi
cmovb esi, eax
lea eax, [esp + 0x64]
push eax
lea eax, [esp + 0x28]
mov dword [esp + 0x24], esi
push eax
call fcn.1020b3e0
add esp, 8
xor eax, eax
test esi, esi
je 0x1020b38c
cmp esi, 0x20
jb 0x1020b364
lea edx, [edi - 1]
lea ecx, [esp + esi + 0x23]
add edx, esi
cmp edi, ecx
ja 0x1020b2dc
lea ecx, [esp + 0x24]
cmp edx, ecx
jae 0x1020b364
lea ecx, [ebx - 1]
add ecx, esi
cmp edi, ecx
ja 0x1020b2e9
cmp edx, ebx
jae 0x1020b364
mov ebp, esi
lea edx, [edi + 0x10]
lea esi, [esp + 0x24]
mov ecx, ebx
sub ecx, esi
and ebp, 0xffffffe0
mov dword [esp + 0x14], ecx
mov ecx, edi
sub ecx, esi
mov dword [esp + 0x18], ecx
mov ecx, ebx
mov ebx, dword [esp + 0x14]
sub ecx, edi
mov esi, dword [esp + 0x18]
mov edi, ecx
mov dword [esp + 0x1c], ecx
nop word [eax + eax]
movups xmm0, xmmword [esp + eax + 0x24]
lea ecx, [ebx + eax]
movups xmm1, xmmword [esp + ecx + 0x24]
lea ecx, [esi + eax]
lea edx, [edx + 0x20]
pxor xmm1, xmm0
movups xmm0, xmmword [esp + eax + 0x34]
add eax, 0x20
movups xmmword [esp + ecx + 0x24], xmm1
movups xmm1, xmmword [edi + edx - 0x20]
pxor xmm1, xmm0
movups xmmword [edx - 0x20], xmm1
cmp eax, ebp
jb 0x1020b320
mov esi, dword [esp + 0x20]
mov edi, dword [esp + 0x10]
mov ebx, dword [esp + 0xb0]
cmp eax, esi
jae 0x1020b38c
lea ecx, [esp + 0x24]
mov ebp, edi
sub ebx, ecx
sub ebp, ecx
lea edx, [esp + 0x24]
add edx, eax
inc eax
mov cl, byte [ebx + edx]
xor cl, byte [edx]
mov byte [edx + ebp], cl
cmp eax, esi
jb 0x1020b372
mov ebx, dword [esp + 0xb0]
mov eax, dword [esp + 0xb4]
add edi, esi
inc dword [esp + 0x94]
sub eax, esi
add ebx, esi
mov dword [esp + 0x10], edi
mov dword [esp + 0xb0], ebx
mov dword [esp + 0xb4], eax
test eax, eax
jne 0x1020b290
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x98]
pop edi
xor ecx, esp
call fcn.10053a94
add esp, 0x98
ret
Function at 0x1020e520
Capabilities:
Encode data using xor

Disassembly:
cmp dword [esp + 0x18], 0
je 0x1020e534
mov dword [esp + 0x18], fcn.1020cd00
jmp fcn.10206540
mov dword [esp + 0x18], fcn.1020bfa0
jmp fcn.10206280
Function at 0x10252320
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0xa8
call fcn.10054ed0
mov eax, dword [0x102fb070]
xor eax, esp
mov dword [esp + 0xa4], eax
mov eax, dword [esp + 0xac]
push ebx
mov ebx, dword [esp + 0xb8]
push ebp
push esi
mov esi, dword [esp + 0xbc]
xor ebp, ebp
mov dword [esp + 0x2c], eax
push edi
mov eax, dword [esi + 8]
mov dword [esp + 0x10], eax
sub eax, ebx
mov dword [esp + 0x24], eax
cmp dword [esi + 0xc], ebx
jae 0x10252380
push 0x4d4
push 0x102daf7c
push str.assertion_failed:_rec__orig_len___md_size
call fcn.10182a20
add esp, 0xc
cmp ebx, 0x40
jbe 0x1025239c
push 0x4d5
push 0x102daf7c
push str.assertion_failed:_md_size___EVP_MAX_MD_SIZE
call fcn.10182a20
add esp, 0xc
mov ecx, dword [esi + 0xc]
lea eax, [esp + 0x34]
neg eax
mov dword [esp + 0x20], ecx
and eax, 0x3f
lea edi, [esp + 0x34]
add edi, eax
lea eax, [ebx + 0x100]
mov dword [esp + 0x2c], edi
cmp ecx, eax
jbe 0x102523ca
mov ebp, ecx
sub ebp, ebx
sub ebp, 0x100
push ebx
xor esi, esi
mov dword [esp + 0x18], 0
push esi
push edi
call fcn.100cd120
add esp, 0xc
mov dword [esp + 0x18], esi
cmp ebp, dword [esp + 0x20]
jae 0x1025247d
mov eax, dword [esp + 0xc0]
mov ecx, ebp
sub ecx, dword [esp + 0x10]
mov dword [esp + 0x1c], ecx
mov eax, dword [eax + 0x14]
mov dword [esp + 0x28], eax
mov eax, ebp
mov edx, ecx
xor eax, dword [esp + 0x24]
xor edx, dword [esp + 0x10]
lea edi, [eax - 1]
not eax
shr eax, 0x1f
shr edi, 0x1f
and edi, eax
mov eax, ebp
xor eax, dword [esp + 0x10]
neg edi
or edx, eax
mov eax, dword [esp + 0x28]
xor edx, ebp
shr edx, 0x1f
neg edx
mov cl, byte [eax + ebp]
mov eax, edi
or eax, dword [esp + 0x14]
inc ebp
and eax, edx
mov edx, dword [esp + 0x18]
and edi, edx
mov dword [esp + 0x14], eax
and al, cl
or esi, edi
mov edi, dword [esp + 0x2c]
or byte [edx + edi], al
inc edx
mov ecx, edx
mov eax, edx
sub ecx, ebx
xor eax, ebx
xor ecx, ebx
or ecx, eax
xor ecx, edx
shr ecx, 0x1f
neg ecx
and edx, ecx
mov ecx, dword [esp + 0x1c]
inc ecx
mov dword [esp + 0x18], edx
mov dword [esp + 0x1c], ecx
cmp ebp, dword [esp + 0x20]
jb 0x10252405
xor edx, edx
test ebx, ebx
je 0x102524b1
mov ebp, dword [esp + 0x30]
mov eax, esi
xor eax, 0x20
mov al, byte [eax + edi]
movzx eax, byte [esi + edi]
inc esi
mov byte [edx + ebp], al
mov ecx, esi
sub ecx, ebx
mov eax, esi
xor ecx, ebx
xor eax, ebx
or ecx, eax
inc edx
xor ecx, esi
shr ecx, 0x1f
neg ecx
and esi, ecx
cmp edx, ebx
jb 0x10252487
mov ecx, dword [esp + 0xb4]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.10053a94
add esp, 0xa8
ret
Function at 0x10252ff0
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0xc
call fcn.10054ed0
push ebx
mov ebx, dword [esp + 0x14]
push esi
mov esi, dword [esp + 0x1c]
push edi
mov eax, dword [ebx + 4]
mov edi, dword [esp + 0x28]
inc edi
mov eax, dword [eax + 0x64]
test byte [eax + 0x34], 1
je 0x1025303d
mov ecx, dword [esp + 0x24]
mov edx, dword [esi + 8]
lea eax, [edi + ecx]
cmp eax, edx
jbe 0x1025302d
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0xc
ret
add dword [esi + 0x14], ecx
sub edx, ecx
add dword [esi + 0x18], ecx
sub dword [esi + 0xc], ecx
mov dword [esi + 8], edx
jmp 0x10253042
cmp edi, dword [esi + 8]
ja 0x10253024
mov ecx, dword [esi + 0x14]
mov eax, dword [esi + 8]
push ebp
push dword [ebx + 0xb0]
mov al, byte [ecx + eax - 1]
movzx ebp, al
mov byte [esp + 0x30], al
mov dword [esp + 0x24], ebp
call fcn.101683b0
push eax
call fcn.10164170
add esp, 8
test eax, 0x200000
je 0x10253088
or eax, 0xffffffff
sub eax, ebp
add dword [esi + 8], eax
mov eax, 1
pop ebp
pop edi
pop esi
pop ebx
add esp, 0xc
ret
mov edx, dword [esi + 8]
lea ecx, [edi + ebp]
mov ebx, edx
mov dword [esp + 0x10], edx
sub ebx, ecx
mov eax, edx
xor ebx, ecx
xor eax, ecx
or ebx, eax
mov eax, 0x100
xor ebx, edx
shr ebx, 0x1f
dec ebx
cmp edx, eax
cmovb eax, edx
xor edi, edi
mov dword [esp + 0x14], eax
test eax, eax
je 0x10253114
mov eax, dword [esi + 0x14]
mov esi, dword [esp + 0x20]
mov edx, esi
mov ebp, dword [esp + 0x10]
shr edx, 0x1f
dec ebp
mov dword [esp + 0x18], edx
add ebp, eax
nop
mov ecx, esi
lea ebp, [ebp - 1]
sub ecx, edi
mov eax, edi
shr ecx, 0x1f
inc edi
shr eax, 0x1f
xor cl, al
xor al, dl
or cl, al
movzx eax, byte [esp + 0x2c]
xor cl, dl
dec cl
movzx edx, cl
movzx ecx, byte [ebp + 1]
xor ecx, eax
and edx, ecx
not edx
and ebx, edx
mov edx, dword [esp + 0x18]
cmp edi, dword [esp + 0x14]
jb 0x102530d0
mov esi, dword [esp + 0x24]
mov ebp, dword [esp + 0x20]
mov edx, dword [esp + 0x10]
not ebx
movzx eax, bl
lea ecx, [eax - 1]
not eax
shr eax, 0x1f
shr ecx, 0x1f
and ecx, eax
lea eax, [ebp + 1]
neg ecx
and eax, ecx
sub edx, eax
mov eax, ecx
pop ebp
pop edi
mov dword [esi + 8], edx
and eax, 1
not ecx
pop esi
or eax, ecx
pop ebx
add esp, 0xc
ret
Function at 0x10258d70
Capabilities:
Send data
Send data on socket

Disassembly:
push esi
mov esi, dword [esp + 8]
mov eax, dword [esi + 0x20]
cmp dword [eax], 5
je 0x10258d8b
push eax
push esi
call fcn.10259430
add esp, 8
test eax, eax
jle 0x10258dd3
push edi
push 0
call dword [sym.imp.WS2_32.dll_WSASetLastError]
push 0
push dword [esp + 0x18]
push dword [esp + 0x18]
push dword [esi + 0x1c]
call dword [sym.imp.WS2_32.dll_send]
push 0xf
push esi
mov edi, eax
call fcn.10163dd0
add esp, 8
test edi, edi
jg 0x10258dd0
push edi
call fcn.101bee90
add esp, 4
test eax, eax
je 0x10258dd0
push 0xa
push esi
call fcn.10164750
add esp, 8
mov eax, edi
pop edi
pop esi
ret
Function at 0x13f5a80
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0xc57000]
push edi
or ebp, 0xffffffff
jmp 0x13f5aa2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x13f5aa9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x13f5a98
mov eax, 1
add ebx, ebx
jne 0x13f5abb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x13f5acc
jne 0x13f5aeb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x13f5aeb
dec eax
add ebx, ebx
jne 0x13f5ad8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x13f5ab0
add ebx, ebx
jne 0x13f5ae7
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x13f5b3d
xor ecx, ecx
sub eax, 3
jb 0x13f5b03
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x13f5b72
sar eax, 1
mov ebp, eax
jmp 0x13f5b0e
add ebx, ebx
jne 0x13f5b0e
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x13f5adc
inc ecx
add ebx, ebx
jne 0x13f5b1c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x13f5adc
add ebx, ebx
jne 0x13f5b29
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x13f5b1e
jne 0x13f5b3a
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x13f5b1e
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x13f5b5c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x13f5b4e
jmp 0x13f5a9e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x13f5b5c
add edi, ecx
jmp 0x13f5a9e
pop esi
mov edi, esi
mov ecx, 0xc5f7
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x13f5b7a
cmp byte [edi], 0x7b
jne 0x13f5b7a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x13f5b7f
lea edi, [esi + 0xff1000]
mov eax, dword [edi]
or eax, eax
je 0x13f5bee
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x1051c20]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x1051d28]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x13f5bac
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x1051d30]
or eax, eax
je 0x13f5be8
mov dword [ebx], eax
add ebx, 4
jmp 0x13f5bc9
call dword [esi + 0x1051d2c]
mov ebp, dword [esi + 0x1051d34]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x21f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x13f5c22
sub esp, 0xffffff80
jmp 0x6947b4
Function at 0x10001de4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
pushal
call 0x10001df3
pop dword [ebp - 0x38]
mov eax, 0x10001df3
sub dword [ebp - 0x38], eax
mov dword [ebp - 0x48], 0xc5381629
add dword [ebp - 0x48], 0x891a2f22
mov dword [ebp - 0x44], 0xac94be66
add dword [ebp - 0x44], 0x859e8ddf
mov dword [ebp - 0x40], 0x587a8300
sub dword [ebp - 0x40], 0xc2e3ed2
mov dword [ebp - 0x3c], 0x2220ebcb
add dword [ebp - 0x3c], 0xdddf1435
lea eax, [ebp - 0x48]
push eax
mov eax, 0xa845bae
sub eax, 0xfa842baa
add eax, dword [ebp - 0x38]
call dword [eax]
mov dword [ebp - 0x48], 0x268c1e4c
add dword [ebp - 0x48], 0x4de64b0a
mov dword [ebp - 0x44], 0x8d1d701d
add dword [ebp - 0x44], 0xb44ef158
mov dword [ebp - 0x40], 0x37994134
add dword [ebp - 0x40], 0x2bd62b38
mov dword [ebp - 0x3c], 0xda296355
sub dword [ebp - 0x3c], 0xda296355
lea ebx, [ebp - 0x48]
push ebx
push eax
mov eax, 0xac82ea38
add eax, 0x637d45d4
add eax, dword [ebp - 0x38]
call dword [eax]
push 0x40
push 0x1000
push 0x359d8
push 0
call eax
mov ecx, 0x4488
mov edx, eax
mov ebx, 0x611a845f
sub ebx, 0x511a205f
add ebx, dword [ebp - 0x38]
mov esi, 0x500d39a
sub esi, 0x7ba0440c
mov dword [ebp - 0x34], 0xb297503b
mov edi, dword [ebx]
add dword [ebp - 0xc], edi
add edi, esi
xor dword [ebp - 0x10], 0xc072d516
mov dword [edx], edi
add dword [ebp - 0x20], edx
add edx, 4
add ebx, 0xd3088e76
add ebx, 0x2cf7718e
loop 0x10001f0a
add eax, 0x595f53fa
sub eax, 0x595e4f07
mov ebx, eax
add eax, 0xbd09785d
add eax, 0x42f687a8
mov ecx, 0x10000000
add ecx, dword [ebp - 0x38]
call ebx
leave
ret
Function at 0x40a561
Capabilities:
Decompress data using aplib

Disassembly:
push ebp
mov ebp, esp
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
cld
mov dl, 0x80
movsb byte es:[edi], byte [esi]
call fcn.0040a5e0
jae 0x40a56d
xor ecx, ecx
call fcn.0040a5e0
jae 0x40a597
xor eax, eax
call fcn.0040a5e0
jae 0x40a5a8
mov al, 0x10
call fcn.0040a5e0
adc al, al
jae 0x40a589
jne 0x40a5d5
stosb byte es:[edi], al
jmp 0x40a56e
call fcn.0040a5ec
dec ecx
loop 0x40a5b4
mov eax, ebp
call fcn.0040a5ea
jmp 0x40a5d6
lodsb al, byte [esi]
shr eax, 1
je 0x40a5fc
adc ecx, 2
mov ebp, eax
jmp 0x40a5d6
xchg ecx, eax
dec eax
shl eax, 8
lodsb al, byte [esi]
mov ebp, eax
call fcn.0040a5ea
cmp eax, 0x7d00
jae 0x40a5d4
cmp eax, 0x500
jae 0x40a5d5
cmp eax, 0x7f
ja 0x40a5d6
inc ecx
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x40a56e
pop ebp
ret 8

Function at 0x414ca0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0xf000]
push edi
jmp 0x414cba
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x414cc1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x414cb0
mov eax, 1
add ebx, ebx
jne 0x414cd3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x414cc8
jne 0x414ce4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x414cc8
xor ecx, ecx
sub eax, 3
jb 0x414cf8
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x414d6a
mov ebp, eax
add ebx, ebx
jne 0x414d03
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x414d10
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x414d34
inc ecx
add ebx, ebx
jne 0x414d20
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x414d15
jne 0x414d31
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x414d15
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x414d54
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x414d45
jmp 0x414cb6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x414d54
add edi, ecx
jmp 0x414cb6
pop esi
lea edi, [esi + 0x12000]
mov eax, dword [edi]
or eax, eax
je 0x414dbc
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x15cac]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x15d68]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x414d71
mov ecx, edi
jns 0x414da0
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x15d70]
or eax, eax
je 0x414db6
mov dword [ebx], eax
add ebx, 4
jmp 0x414d8e
call dword [esi + 0x15d6c]
mov ebp, dword [esi + 0x15d74]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x207]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x414df0
sub esp, 0xffffff80
jmp 0x403966
Function at 0x3001e320
Capabilities:
Encode data using xor

Disassembly:
xor dword [ecx], eax
insb byte es:[edi], dx
pop edi
pop esi
pop ebp
xor byte [edx + 2], 6
lea ecx, [ecx + 0xf]
dec ecx
lmsw word [edi]
dec ecx
lmsw word [edi]
stosb byte es:[edi], al
add dword [ecx + 0x873017b], eax
cmp byte [esi + 0x42], 0x20
add dword [ebp + 0x52], esi
push 0x20
and byte [edi + 0x56], 0xe8
push esp
js 0x3001e315
and dword [edi + 0xc], 0x810c6780
cmp al, bh
movsb byte es:[edi], byte [esi]
add byte [edi], al
add byte [ebx], ch
jmp 0x3001e369
pop esi
ret

Function at 0x3001fb81
Capabilities:
Encode data using xor

Disassembly:
or dword [ecx], 0x35982484
les eax, [ecx]
invalid

Function at 0x3001ff8b
Capabilities:
Encode data using xor

Disassembly:
inc eax
jno 0x3001fff2
call 0x300f802c
mov ebx, eax
add esp, 0x20
cmp ebx, 0xffffffff
sbb byte [edi + ebx*2 - 0x75], dh
jmp 0x4895b0bc
and byte [eax + 0x4a2d374], al
mov ss, word [eax]
rol dword [ecx], 0xe1
add esi, dword [ecx]
push es
xor ebx, ebx
push esi
jo 0x30020007
add edx, dword [eax + 7]
pop es
and byte [ecx + 0x52], al
push edi
setne bl
call 0x36f65e1a
jne 0x3002008a
adc bl, al
sub esp, 0x44
push ebp
lock sub dword [eax - 0x50], ecx
or ebx, dword [eax + 0x71]
sub edx, dword [edx + esi*2 + 0x2b]
jno 0x30020056
pop eax
ret
push 0xf5ef2113
mov ah, 3
mov eax, 0xf1442115
mov ah, 0xf1
add dword [ecx], edx
and dword [eax + 0x661c2020], esp
mov ecx, dword [ebp + 0x32]
and byte [ebx], cl
push eax
lodsb al, byte [esi]
mov eax, dword [ebp - 0x5c]
invalid
push cs
adc byte [ebx], 0
add bl, dl
call 0x8be2dbc8
feni8087_nop
pop ebx
push eax
xor byte [esi - 0x75], ah
pop ebp
mov eax, dword [0x48b024b0]
inc esp
sbb byte [ebx], al
fld dword [eax + 0x43]
inc ebx
stosb byte es:[edi], al
push eax
add ch, byte [ebx + esi]
rol byte [ecx + 0x40], 3
and al, 3
ror dword [ebx + 0x3c90714e], 0xb0
lea eax, [ebx + edx*8 - 8]
push eax
push ecx
nop
add dword [edx + edx - 0x60], esp
mov ebx, 0x9fe4b1c0
xchg edx, eax
movsb byte es:[edi], byte [esi]
or byte [edx], 0xa0
or al, 0x60
ror byte [edx], 0x7d
pushal
or al, 0x42
lds ecx, [edx]
lds edi, [edi + 0x32b20ac0]
movsb byte es:[edi], byte [esi]
push ebp
push 0xa132b95b
and eax, 0x106158
punpcklbw mm4, dword [ebx - 0x54fddb]
add edx, dword [eax + 0x200340e]
xor byte [eax + 0xa632002], al
and bl, dl
loop 0x3002008b
dec esi
add al, 0x92
js 0x30020092
inc esp
pop esp
add al, byte [ecx]
ror byte [ecx], 1
nop
or dword [eax], eax
or ah, byte [eax]
int1
dec esp
je 0x30020151
aam 9
sbb byte [ebp + edx*4 - 0x584bf83e], dh
leave
pop es
jne 0x300200a4
adc ah, byte [esi - 0x80]
add eax, 0x5506620
sub al, 0x66
sub dword [eax*2 + 0x2400703a], eax
mov word [ebp + 0x14], dx
sti
nop
add eax, 0x708b0500
lodsd eax, dword [esi]
loope 0x3002014e
xor dword [ecx - 0x70], eax
scasb al, byte es:[edi]
push eax
push 0x973151b6
inc edx
sub ebp, dword [eax + 0x50]
xor ah, byte [eax - 0x3a]
push ebp
mov al, 1
retf
Function at 0x4010bc
Capabilities:
Execute anti-debugging instructions

Disassembly:
push ebx
push ecx
push 1
pop eax
cpuid
test ecx, 0x40000000
setne al
test al, al
je 0x4010d9
rdrand eax
rdrand edx
pop ecx
pop ebx
ret
push 7
pop eax
xor ecx, ecx
cpuid
test ebx, 0x40000
setne al
test al, al
je 0x4010f6
rdseed eax
rdseed edx
pop ecx
pop ebx
ret
rdtsc
mov ecx, eax
ror ecx, 0xd
rdtsc
mov edx, eax
rol edx, 0xd
mov eax, ecx
pop ecx
pop ebx
ret