joyce8/EMBER2024-capa huggingface dataset:
Function at 0x17a3f7b
Capabilities:
Encrypt data using rc4 prga

Disassembly:
inc ecx
ror eax, cl
dec esi
mov dword [esp + ebp - 0x2098d31], edx
inc edx
movzx ebx, byte [esp + ebp - 0x2098d2e]
inc edi
lea eax, [ebp + eax - 0x4f9994eb]
inc ebp
mov esi, ebp
dec esi
mov dword [esp + ebp*2 - 0x4131a5a], ebx
call fcn.012362ab
jno 0x17a3f2e
or bl, cl
pop ds
inc esi
inc eax
mov dh, bl
sar edi, cl
cmp byte [eax - 0x7e], ch
sar edi, cl
push edx
bound ecx, qword [esi]
or byte [0x51a67fdf], al
add al, 0x2a
invalid

Function at 0x17a541a
Capabilities:
Encode data using base64

Disassembly:
dec eax
mov dword [esp + edx - 0x19bdcc2b], edi
call fcn.0124b98a

Function at 0x17a5436
Capabilities:
Encode data using base64

Disassembly:
mov dword [esp], eax
neg edx
sub eax, 0xc435cc8e
bswap edx
call fcn.01376bbc
bswap edx
jl 0x135176b

Function at 0x17a6473
Capabilities:
Encode data using base64
Execute anti-debugging instructions

Disassembly:
dec edx
mov dword [esp - 0xed7c], edx
inc edx
xor dword [esp - 0xed74], edi
dec esi
mov ebx, dword [esp - 0xed74]
inc ebp
movzx esi, sp
dec eax
arpl di, di
dec eax
add esi, edi
dec eax
mov dword [esp + ecx*4 - 0x1daf4], edx
dec esp
lea eax, [ecx + ecx - 0x177d1445]
mov ebx, edx
inc di
mov esp, dword [esp + ecx - 0x76be]
inc bp
mov ebp, dword [ecx + ecx - 0x76bd]
movsx ebp, byte [esp + ecx*2 - 0xed72]
sar byte [esp + ecx - 0x76bc], 0xe1
call fcn.013a5a9c

Function at 0x17a9e8e
Capabilities:
Encode data using xor

Disassembly:
lea esi, [esi + ecx - 0x5c39e29b]
push eax
mov edx, dword [esi + ecx - 0x5c39e297]
xor edx, ebx
not edx
call fcn.0122368f
mov edx, 0xb503a209
movsx eax, dl
inc esp
movsx eax, dx
dec ebp
lea edi, [edi + eax - 0xd]
inc al
dec eax
lea edi, [eax - 0x5ee10ad9]
inc ecx
mov edx, dword [edi + edi + 0x5ee10acf]
and edi, 0xa10ef4a2
inc esp
xadd eax, eax
inc ecx
xor edx, ebx
dec esp
lea ebp, [eax*2 + 0x789b5831]
dec ecx
rol ebp, 0xa5
inc esp
mov esp, eax
dec edx
neg edx
call fcn.01308761
loopne 0x17a9ed3
push 0xddde146
invalid

Function at 0x17aedd9
Capabilities:
Encode data using xor

Disassembly:
lea edx, [eax + eax*8 + 0x2b32ca37]
mov edx, dword [ebp + eax - 0x1f304e10]
push eax
mov ecx, dword [ebp + eax*4 - 0x7cc1383c]
call fcn.0175edf1
not ah
test byte [ecx + 0x7d], dh
invalid
jno 0x17aee76
sbb eax, 0xf4da5187
xor dl, dh
js 0x17aedf1
invalid
in al, dx
idiv byte [esi]
salc
js 0x17aedf7
cwde
scasb al, byte es:[edi]
push 0xffffffffffffffd6
js 0x17aedfd
mov eax, 0x78d64e96
out dx, al
in al, 0xec
stosb byte es:[edi], al
clc
inc edi
and dword [edi], edx
jns 0x17aee97
xchg esi, eax
xchg byte [edi - 0x291fc4ce], al
pop esp
imul edi, dword [ebp + ebp*8 - 8], 0xffffff9f
lcall 0x13a, 0xa52a6a91
hlt
clc
mov word [ecx], es
aam 0xa0
into
xchg ecx, eax
Function at 0x17b7b25
Capabilities:
Encode data using base64

Disassembly:
inc ecx
not eax
inc ecx
rol eax, 2
inc esp
movzx esi, bl
inc esi
lea eax, [ecx + eax + 0x522f097b]
pop ecx
dec edx
mov dword [esp + esi*4 - 0x2c0], ebp
inc ecx
not eax
inc eax
inc ch
call fcn.01310e43
cmc
sbb al, 0xb9
fstp dword [edx]
mov esp, 0x3c632fe
loop 0x17b7bcc
jg 0x17b7bad
push edx
add ebx, eax
pop edi
inc ecx
mov edi, dword [edi]
inc ecx
mov esi, 0xa810a0b4
dec edx
lea edx, [esi*8 - 0x23d42570]
call fcn.0175f364
jg 0x17b7bf3
movsd dword es:[edi], dword [esi]
dec edi
lea ecx, [ecx + esi - 0x5abb8094]
jmp 0x1365b2b
inc edx
and ch, al
xchg esp, eax
adc bh, byte [edi + edi*8 - 0x25e30d7f]
cmp byte [ecx + 0xfc1ff66], bl
mov bh, 0xc1
neg edx
call fcn.0133c8fa
mov eax, 0x4ba6eb00
mov ch, 0xe2
aad 0xf9
inc ebx
mov ah, 0x64
int3

Function at 0x17b987f
Capabilities:
Encode data using base64

Disassembly:
mov dl, byte [ebp + edx*8 - 0x747dc]
call fcn.01357c70
test esp, 0x9435a887

Function at 0x17bfca2
Capabilities:
Encode data using xor

Disassembly:
inc ecx
xor esi, 0x4018bf00
dec esi
mov dword [esp], ebx
inc esi
xor dword [esp], esi
inc ecx
dec ch
dec eax
lea ebx, [eax*4 - 0x355c2759]
inc ecx
add bh, ah
inc ecx
pop ebx
rol dl, 0xc4
inc cl
dec ebp
arpl si, si
inc ecx
not edx
dec ecx
shr esp, cl
dec ecx
adc esi, esi
call fcn.0135437e
cmpsd dword [esi], dword es:[edi]
call 0xce386560
and al, 0x43
or dword [eax - 0x68], 0x814338f6
dec eax
mov bl, byte [esp + ecx*2 - 0xdb77ebd]
loop 0x17bfd4f
inc ebx
or dword [eax - 0xe], 0x117d5fe2
jge 0x17bfd03
jmp 0xb7396e31
mov ebx, 0x7d672ddb
push ds
mov edx, ebp
xlatb
cmp ch, byte [0xb6090ffd]
xlatb
dec ecx
pop ebx
stosd dword es:[di], eax
or esi, ebp
daa
jecxz 0x17bfcea
bound eax, qword [ebp - 0x57aba631]
mov ebp, 0xee2475c
out dx, eax
jle 0x17bfd68
jbe 0x17bfd11
mov esp, 0xb37bee1b
cmpsd dword [esi], dword es:[edi]
fisub dword [esi]
lahf
stosd dword es:[edi], eax
and dword [eax + ebp*8 + 0x54], 0xffffff8e
loop 0x17bfd85
sar ecx, 0x94
cmp dword [ebx - 0x35], ebx
push esp
call 0x6076d1c9
sbb ebx, 0xfffffffe
mov ecx, 0xa52b5e05
movsd dword es:[edi], dword [esi]
jecxz 0x17bfcfd
adc ecx, dword [0xdf3349f]
xor dword [esi + 0x3d705a86], ecx
mov al, byte [0x57af897d]
cli
dec esi
jae 0x17bfd4b
mov edx, 0x62a9e272
jge 0x17bfdaf
bound edi, qword [ebp + 0x44]
push ebx
stc
and byte [ebp - 0x58439a35], dl
invalid
invalid
mov dword [ebp - 0x110f8900], ebp
xor dword [edx + 0x26], 0xdbd6327c
mov dword [0x934f0ee0], eax
les ebp, [ebx + 0x1b]
cmc
push 0x55
das
iretd
Function at 0x17c39a2
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
ret
mov dword [ebp - 4], ecx
stc
test ecx, ecx
jmp 0x1327dd0
mov eax, dword [edx + 0x3c]
cmc
cmp sp, bp
cmp ax, 0x9485
lea eax, [eax + edx]
cmp dword [eax], 0x4550
jmp 0x1398c79
je 0x1253e47
xor eax, eax
mov esi, 0x82bd04b4
bswap esi
pop esi
jmp 0x17d13cb
test edi, edi
je 0x17b91a5
mov eax, dword [ecx + edx + 0x20]
jmp 0x1238e9c
je 0x125a23f
mov esi, dword [ebp + 0xc]
cmp di, 0xac0f
test esi, esi
jmp 0x133deb4
jmp 0x17b919f
je 0x125a23f
mov eax, dword [eax + 0x7c]
cmp ebx, 0x2a09093a
test ebp, 0xb4b08f07
push ebx
push edi
mov dword [ebp - 0x10], eax
cmp di, bx
mov dword [ebp - 8], 0xffffffff
test si, 0x2121
cmp esi, 0xffff
jmp 0x1791fdd
je 0x125a23f
mov eax, 0x5a4d
cmc
cmp esp, esp
cmp word [edx], ax
jmp 0x125a239
mov edi, dword [ecx + edx + 0x18]
jmp 0x131f0cb
test edx, edx
jmp 0x132088e
jne 0x125a23f
mov ecx, dword [eax + 0x78]
cmp ecx, esp
jmp 0x123c64b
ja 0x1356db4
mov eax, esi
clc
sub eax, dword [ecx + edx + 0x10]
jmp 0x1322c97
push ebp
sar dx, cl
shld bp, sp, 0x1e
btc dx, 0xb
mov ebp, esp
bsf dx, bp
bts edx, edi
adc edx, 0x7c8b5707
mov edx, dword [ebp + 8]
cmp bx, 0xccaa
cmc
lea esp, [esp - 0x114]
cmp edi, 0xb087dd90
cmp ch, ch
push esi
test di, 0x3314
jmp 0x1357b55
mov esp, ebp
pop ebp
jmp 0x123b343

Function at 0x17c950f
Capabilities:
Encode data using xor
Manually build aes constants

Disassembly:
not word [esp + edx - 0x572ad2b6]
shr edx, 0x66
xor ebx, ecx
jmp 0x132983b
ror ax, 0x4c
add edi, ecx
movzx ecx, byte [esp + edx*2 - 0x2b95689]
sub cl, byte [esp + ecx*2 - 0x7f]
xadd byte [esp + edx*8 - 0xae55a46], cl
pop edx
pop eax
pop ecx
pop eax
pop edx
pop eax
pop ecx
jae fcn.01798914
inc ebp
movzx edx, ah
inc eax
inc ecx
mov ecx, edx
dec ecx
xor edx, 0x17115526
inc ecx
mov edi, edx
ror eax, 3
inc ecx
lea eax, [esp + eax + 0xc0519d7]
dec ecx
sar edx, cl
not di
bswap eax
inc cx
add ecx, ebp
dec eax
xadd edi, edx
inc ecx
push ebx
ror di, 0x8e
jnp 0x17720c9
adc eax, 0x1178e814
cwde
leave
ror dh, 1
jnp 0x1329926
mov eax, dword [0x596eda76]
push edi
popfd
jbe 0x132988a
outsb dx, byte [esi]
xor eax, 0xda76d113
outsb dx, byte [esi]
outsd dx, dword [esi]
and eax, ecx
jbe 0x1329896
outsb dx, byte [esi]
and dword [ebx], eax
pop es
mov eax, 0x42f9b581
retf 0x6a48
xchg cl, cl
not ecx
jmp 0x17ae99c
neg ecx
bswap ecx
call fcn.017c293e
mov ecx, dword [esi + edx - 0x71af4993]
ror dword [esp + edx - 0x71af4984], 0x11
xor ecx, ebx
inc ecx
or word [esp + edx - 0x71af497e], dx
bswap ecx
mov dword [esp + edx - 0x71af498b], 0xeca97b37
mov dword [esp + edx - 0x71af498f], 0x4dafe118
mov dword [esp + edx - 0x71af4993], 0x572ad2ba
neg ecx
pop edx
push edx
not ecx
add dl, byte [esp + edx - 0x572ad2ac]
push eax
sbb ecx, 0x9c3a743a
xadd dword [esp + edx - 0x572ad2a4], eax
and word [esp + edx - 0x572ad2ae], dx
shl al, 0xa5
bswap ecx
jne 0x122731a
dec eax
mov dword [esp + edx*8 - 0x7fce0], esi
ret 0x20
Function at 0x17cb00f
Capabilities:
Encode data using xor

Disassembly:
call fcn.013492c0
call [0xbd00d18b]
shl dword [eax], 0xfd
and al, 0xe5
jae 0x17cb09a
inc ebp
push edx
bound eax, qword [ecx - 0x6be8670e]
xor edx, 0x17941798
not edx
dec esi
mov dword [esp + eax*2 - 0x1b874], ebx
inc cx
and eax, 0x416615b0
or ecx, esi
call fcn.01251dee
mov eax, 0x51117423
lea edx, [eax*8 - 0x43eebdd4]
mov eax, ebp
call fcn.012369cc
int1
test al, 0x67
scasd eax, dword es:[edi]
insd dword es:[edi], dx
sub byte [ecx], dl
xor edi, esi
insd dword es:[edi], dx
sub byte [0xf36db35b], ah
sub byte [edi], al
adc eax, 0x28f36dc7
popal
outsd dx, dword [esi]
mov dword [0x1728f36d], eax
cmp esi, dword [ebp + 0x71]
ror byte [ebx - 0x79], cl
or eax, 0x2d9d53ae
in eax, 0x3e
adc al, 0x20
push 0x269eb062
jge 0x17cb05c
sahf
jge 0x17cb05c
shr byte [esi + 0x27], 1
cmp ebx, ebp
cmc
insb byte es:[edi], dx
dec esp
inc eax
mov bl, 0xb0
out dx, al
or byte [esp + esi], ch
mov bl, 0xb0
out dx, al
jl 0x17cb0d6
jo 0x17cb067
mov al, 0xee
cmp byte [eax + ebp], dh
mov bl, 0xb0
out dx, al
pushal
shl byte [ecx + 0x1e38c52b], 0xf8
xor dword [0xfa3da947], edi
mov cl, 0x49
cmp ecx, ebx
cmp eax, 0x156db1fa
leave
cmp eax, 0x7b6fb1fa
test eax, 0x7db1fa3d
add eax, 0xb1fa3db9
inc ecx
mov cl, 0x6f
jnp 0x17cb083
cmp eax, 0x57db1fa
mov ecx, 0x41b1fa3d
jg 0x17cb111
ja 0x17cb06a
inc edx
push ds
or edi, esi
pop edx
add al, 0x27
mov ch, 0x37
in eax, dx
or al, 0x2f
stosb byte es:[edi], al
jge 0x17cb125
invalid
out dx, al
test ah, cl
mov esp, 0xf4eeb0b2
sbb al, 0xa0
sub eax, ebp
lodsd eax, dword [esi]
lodsb al, byte [esi]
popfd
sal dword [edi], cl
inc ebp
push edi
inc edx
ror dl, 1
sbb al, 0x5b
pop esp
mov byte [0x5b08eaa8], al
pop esp
mov byte [0xaaecf8fe], al
sub dword [ebx + esi + 0x77b4f435], ebp
pop ebp
xchg ecx, eax
popal
add bh, ch
sbb edi, edi
push 0xc3ec1ab6
mov dl, 0x32
test eax, 0xa6f82170
xor al, byte [esi + 0x10c0d9a5]
jp 0x17cb131
sbb ch, ah
ret
push 0xffffffffffffffdf
and ebx, dword ss:[eax]
sub esp, dword [ebp - 0x4c]
bswap esp
adc byte [edx + 0xf6563e0], 0x35
mov cl, 0x6c
adc eax, 0x2168494
je 0x17cb146
arpl word [ebx], bp
wait
or eax, dword [edi]
mov ebx, 0xf4425e83
mov esp, 0x265767c2
fdivr qword [eax - 0x26ec64ef]
into
mov word [esi + 0x21], ds
xor eax, 0x5964d49b
mov al, byte [0x59d6c5a9]
int3
Function at 0x17cb53c
Capabilities:
Encrypt data using rc4 prga

Disassembly:
ret
shr edx, 1
mov al, 0x3c
add ax, ax
cmovs eax, esp
movzx eax, dl
mov edx, eax
stc
cmp ax, sp
lea ecx, [ecx]
test dh, 0x2b
add cl, 0xf7
sub eax, 1
jmp 0x1315deb
jne 0x1354a46
mov dword [edi + 8], edx
cmp di, 0xe10c
test edx, edi
cmc
mov dword [edi + 4], 0
jmp 0x176b215
mov dword [edi + 8], 0
test si, 0x4119
test ebp, eax
cmp cl, 0x2d
jmp 0x131a4bf
jne 0x123b0b5
mov dword [edi + 4], edx
not ax
movzx eax, cl
cmp edi, 0xa8ac87a4
jmp 0x1775397
jb 0x125b18c
push esi
neg edx
rdtsc
movzx esi, cl
movzx ax, al
mov eax, 0x6c16c16d
mul esi
mov eax, esi
dec esi
xor si, 0xf6b0
sub eax, edx
btc esi, ebp
shr eax, 1
movzx esi, bx
rcl si, 0xa6
lea eax, [eax + edx]
shrd dx, di, 0xac
or esi, 0x2b28e332
shr eax, 5
btr esi, esp
movzx eax, al
setg dh
sub dx, sp
add dh, 0x88
mov edx, eax
and esi, esp
adc esi, ebp
or si, si
pop esi
jmp 0x1354a46
jb 0x1315df7
movzx edx, cl
clc
mov eax, 0x38e38e39
test ecx, eax
stc
test edi, 0xa3124100
mul edx
sbb eax, ebp
jmp 0x123b09c
add cl, 0xd3
clc
cmp sp, 0xab01
sub eax, 1
jmp 0x125b17b
ret
xor eax, eax
jmp 0x1357de1
cmp cl, 9
jmp 0x134f3dd
jb 0x1268336
mov eax, 1
jmp 0x12321b5
mov dword [edi], eax
jmp 0x1376e6c
shr cl, 0x81
call fcn.01357b66
mov cl, byte [eax]
clc
cmc
cmp cl, 0xe1
jmp 0x176f0bf

Function at 0x17cef81
Capabilities:
Encode data using base64

Disassembly:
xor ecx, 0x56ac5abb
lea eax, [eax + edx*4 - 0x22e06846]
sub dword [esp + eax - 0x3a4be37a], eax
xor ebx, ecx
sar word [esp + eax*2 - 0x7497c6f4], 0xa6
adc edi, ecx
call fcn.0177591b
call fcn.013120b2
xor ecx, 0x38a5eb14
xadd dword [esp + eax - 0x69315484], eax
sbb ecx, 0xeba2f91b
movsx edx, byte [esp + eax - 0x5d2c4d1c]
jmp 0x1793212
Function at 0x403c30
Capabilities:
Check mutex on windows
Get system information on windows
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1c4
mov eax, dword [0x496074]
xor eax, esp
mov dword [esp + 0x1c0], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, ecx
mov dword [0x499600], edi
mov dword [edi + 0x48], eax
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [esp + 0x28]
push str.GlobalA8697E6F_9116_1778_8E9C_A16689B70ACC
add eax, eax
mov dword [edi + 0x3c], eax
mov eax, dword [esp + 0x1c]
push 0
mov dword [edi + 0x40], eax
push 0
push 0
mov dword [edi + 0x68], 1
mov dword [edi + 0x6c], 0
mov dword [edi + 0x70], 1
mov dword [edi + 0x74], 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [edi + 0x4c], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x403e03
lea eax, [esp + 0x38]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
mov dword [esp + 0x10], eax
test eax, eax
je 0x403cf0
lea eax, [esp + 0x10]
mov edx, str.CCoreServer::_Winsock2Init
push eax
push 0x151
mov ecx, str.WSAStartup_failed_with_error:__d
call fcn.00407570
add esp, 8
jmp 0x403e03
mov eax, dword [esp + 0x38]
cmp al, 2
jne 0x403de6
shr eax, 8
cmp al, 2
jne 0x403de6
push 0x15d
mov edx, str.CCoreServer::_Winsock2Init
mov ecx, str.The_Winsock_2.2_dll_was_found_okay_n
call fcn.004073d0
add esp, 4
mov ecx, edi
call fcn.00404360
test al, al
je 0x403e03
mov ebx, dword [sym.imp.LIBEAY32.dll_Ordinal_1804]
call ebx
push 0x29
push str.d:working_directorydydyxtduservicelibcurlhttpclient2.cpp
call ebx
shl eax, 2
push eax
call dword [sym.imp.LIBEAY32.dll_Ordinal_188]
add esp, 0xc
mov dword [0x49972c], eax
xor esi, esi
call ebx
test eax, eax
jle 0x403d74
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov ecx, dword [0x49972c]
mov dword [ecx + esi*4], eax
inc esi
call ebx
cmp esi, eax
jl 0x403d58
push 0x422820
call dword [sym.imp.LIBEAY32.dll_Ordinal_197]
add esp, 4
push sub.KERNEL32.dll_GetCurrentThreadId
call dword [sym.imp.LIBEAY32.dll_Ordinal_196]
add esp, 4
cmp byte [0x4997a8], 0
jne 0x403dab
push 3
mov byte [0x4997a8], 1
call dword [sym.imp.libcurl.dll_curl_global_init]
add esp, 4
mov ecx, edi
call fcn.00403ff0
test al, al
je 0x403e03
push 0x86
mov edx, str.CCoreServer::Run
mov ecx, 0x487304
call fcn.004073d0
add esp, 4
mov al, 1
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x1c0]
xor ecx, esp
call fcn.0043930f
mov esp, ebp
pop ebp
ret 4
push 0x157
mov edx, str.CCoreServer::_Winsock2Init
mov ecx, str.Could_not_find_a_usable_version_of_Winsock.dll_n
call fcn.004073d0
add esp, 4
call dword [sym.imp.WS2_32.dll_WSACleanup]
mov ecx, edi
call fcn.00403e40
push 0x8d
mov edx, str.CCoreServer::Run
mov ecx, 0x487318
call fcn.004073d0
mov ecx, dword [esp + 0x1d0]
add esp, 4
xor al, al
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0043930f
mov esp, ebp
pop ebp
ret 4
Function at 0x43ad82
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret

Function at 0x4687eb
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0046866a

Function at 0x46d9b4
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0046d674

Function at 0x407f80
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x6000]
push edi
or ebp, 0xffffffff
jmp 0x407fa2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x407fa9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x407f98
mov eax, 1
add ebx, ebx
jne 0x407fbb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x407fb0
jne 0x407fcc
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x407fb0
xor ecx, ecx
sub eax, 3
jb 0x407fe0
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x408052
mov ebp, eax
add ebx, ebx
jne 0x407feb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x407ff8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x40801c
inc ecx
add ebx, ebx
jne 0x408008
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x407ffd
jne 0x408019
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x407ffd
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x40803c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x40802d
jmp 0x407f9e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x40803c
add edi, ecx
jmp 0x407f9e
pop esi
mov edi, esi
mov ecx, 0x8f
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x40805a
cmp byte [edi], 0
jne 0x40805a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x40805f
lea edi, [esi + 0x5000]
mov eax, dword [edi]
or eax, eax
je 0x4080d7
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x8d64]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x8ddc]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x40808c
mov ecx, edi
jns 0x4080bb
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x8de4]
or eax, eax
je 0x4080d1
mov dword [ebx], eax
add ebx, 4
jmp 0x4080a9
call dword [esi + 0x8de0]
mov ebp, dword [esi + 0x8de8]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x217]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x40810b
sub esp, 0xffffff80
jmp 0x402130
Function at 0x10ad0cc
Capabilities:
Encode data using xor

Disassembly:
jmp 0x10ad0d6
pushal
call 0x10ad0dc
pop ebp
sub ebp, 0x10
sub ebp, 0xcad0cc
jmp 0x10ad0f2
mov eax, 0xcad0cc
add eax, ebp
add eax, 0x4c
mov ecx, 0x5d0
mov edx, 0xe66a8e12
xor byte [eax], dl
inc eax
dec ecx
jne 0x10ad109
jmp 0x10ad11c
cdq
fistp word [ecx + 0x12122e9b]
adc dl, byte [ebx + 0x1212ead3]
adc dl, byte [ecx]
fild qword [edx + 0x1212121a]
test al, 0x3a
adc dl, byte [edx]
adc ah, ch
invalid

Function at 0x407f80
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x6000]
push edi
or ebp, 0xffffffff
jmp 0x407fa2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x407fa9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x407f98
mov eax, 1
add ebx, ebx
jne 0x407fbb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x407fb0
jne 0x407fcc
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x407fb0
xor ecx, ecx
sub eax, 3
jb 0x407fe0
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x408052
mov ebp, eax
add ebx, ebx
jne 0x407feb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x407ff8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x40801c
inc ecx
add ebx, ebx
jne 0x408008
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x407ffd
jne 0x408019
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x407ffd
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x40803c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x40802d
jmp 0x407f9e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x40803c
add edi, ecx
jmp 0x407f9e
pop esi
mov edi, esi
mov ecx, 0x8f
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x40805a
cmp byte [edi], 0
jne 0x40805a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x40805f
lea edi, [esi + 0x5000]
mov eax, dword [edi]
or eax, eax
je 0x4080d7
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x8d64]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x8ddc]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x40808c
mov ecx, edi
jns 0x4080bb
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x8de4]
or eax, eax
je 0x4080d1
mov dword [ebx], eax
add ebx, 4
jmp 0x4080a9
call dword [esi + 0x8de0]
mov ebp, dword [esi + 0x8de8]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x217]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x40810b
sub esp, 0xffffff80
jmp 0x402130
Function at 0x405ef4
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x422a34], 0
push esi
jne 0x405f2b
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x405f05
mov dword [ecx*4 + 0x422a30], eax
inc ecx
cmp ecx, 0x100
jl 0x405f00
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x405f5c
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x422a30]
xor eax, esi
inc ecx
dec edx
jne 0x405f3e
pop edi
not eax
pop esi
ret 0xc

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x408ecc
mov ecx, 0x54e53b81
nop
nop
nop
nop
nop
test eax, eax
je 0x43004e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
jne 0x430024
nop
nop
nop
nop
mov eax, str.s0a
nop
mov ebx, 0x42e1d0
nop
nop
mov ecx, 0x303314d1
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x430084
xor dword [eax], ecx
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43006c
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x401219