joyce8/EMBER2024-capa huggingface dataset:
Function at 0x49daa2
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x11c
mov eax, dword [0x518860]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 8], 0x800
push ebx
push esi
mov esi, ecx
mov ebx, edx
lea eax, [ebp - 0x11c]
jne 0x49dae2
push 0x4ea540
push 4
push eax
call fcn.004b5e25
push eax
call fcn.0040e220
add esp, 0x10
jmp 0x49daf4
push 4
push eax
push 3
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
test eax, eax
je 0x49db62
push edi
call fcn.004b232d
mov edi, dword [eax]
call fcn.004b232d
and dword [eax], 0
lea eax, [ebp - 0x11c]
push eax
push ebx
push esi
push 0x111
mov esi, 0x112
lea eax, [ebp - 0x118]
push esi
push eax
call fcn.004b0a49
add esp, 0x18
mov ebx, eax
call fcn.004b232d
cmp dword [eax], 0
je 0x49db42
call fcn.004b232d
push dword [eax]
call fcn.0047af40
pop ecx
jmp 0x49db49
call fcn.004b232d
mov dword [eax], edi
cmp ebx, 0xffffffff
pop edi
je 0x49db62
cmp ebx, esi
jae 0x49db62
lea eax, [ebp - 0x118]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
jmp 0x49db64
xor eax, eax
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.004b5576
leave
ret
Function at 0x49ed59
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
xor ebx, ebx
cmp dword [ebp + 0xc], ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], ebx
je 0x49ed9f
call fcn.0049200d
mov esi, dword [eax + 0xc]
push 0xf0
push dword [ebp + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x49ed9f
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
mov dword [ebp - 4], eax
je 0x49ede2
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
test ebx, ebx
mov esi, dword [ebp + 8]
mov dword [ebp + 0xc], 1
je 0x49edcb
push dword [ebp + 0x10]
mov eax, dword [edi]
push ebx
push esi
mov ecx, edi
call dword [eax + 0x20]
cmp dword [ebp - 4], 0
mov dword [ebp + 0xc], eax
je 0x49edcb
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FreeResource]
cmp dword [esi + 0x4c], 0
je 0x49eddf
mov ecx, dword [esi + 0x4c]
push dword [ebp + 0x10]
mov eax, dword [ecx]
call dword [eax + 0xa0]
mov eax, dword [ebp + 0xc]
pop edi
pop esi
pop ebx
leave
ret 0xc

Function at 0x4b5576
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x518860]
jne 0x4b5580
repz ret
jmp fcn.004c4b9b
Function at 0x4b86cf
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov ecx, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
xor edi, edi
cmp dword [ebp + 0x10], edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], ebx
je 0x4b870c
cmp dword [ebp + 0x14], edi
je 0x4b870c
cmp ecx, edi
jne 0x4b8713
call fcn.004b232d
push edi
push edi
push edi
push edi
mov dword [eax], 0x16
push edi
call fcn.004b3b3f
add esp, 0x14
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
mov esi, dword [ebp + 0x18]
cmp esi, edi
je 0x4b8727
or eax, 0xffffffff
xor edx, edx
div dword [ebp + 0x10]
cmp dword [ebp + 0x14], eax
jbe 0x4b8748
cmp ebx, 0xffffffff
je 0x4b8737
push ebx
push edi
push ecx
call fcn.004b0a70
add esp, 0xc
cmp esi, edi
je 0x4b86f4
or eax, 0xffffffff
xor edx, edx
div dword [ebp + 0x10]
cmp dword [ebp + 0x14], eax
ja 0x4b86f4
mov edi, dword [ebp + 0x10]
imul edi, dword [ebp + 0x14]
test word [esi + 0xc], 0x10c
mov dword [ebp - 0x10], edi
mov ebx, edi
je 0x4b8764
mov eax, dword [esi + 0x18]
mov dword [ebp - 0xc], eax
jmp 0x4b876b
mov dword [ebp - 0xc], 0x1000
test edi, edi
je 0x4b885c
test word [esi + 0xc], 0x10c
je 0x4b87bf
mov eax, dword [esi + 4]
test eax, eax
je 0x4b87bf
jl 0x4b88bd
cmp ebx, eax
mov edi, ebx
jb 0x4b8790
mov edi, eax
cmp edi, dword [ebp - 4]
ja 0x4b8864
push edi
push dword [esi]
push dword [ebp - 4]
push dword [ebp - 8]
call fcn.004b0468
sub dword [esi + 4], edi
add dword [esi], edi
add dword [ebp - 8], edi
sub ebx, edi
add esp, 0x10
sub dword [ebp - 4], edi
mov edi, dword [ebp - 0x10]
jmp 0x4b8854
cmp ebx, dword [ebp - 0xc]
jb 0x4b882c
cmp dword [ebp - 0xc], 0
je 0x4b87e9
mov ecx, SysReAllocString
xor edx, edx
cmp ebx, ecx
jbe 0x4b87de
mov eax, ecx
div dword [ebp - 0xc]
mov eax, ecx
jmp 0x4b87e5
mov eax, ebx
div dword [ebp - 0xc]
mov eax, ebx
sub eax, edx
jmp 0x4b87f4
mov eax, SysReAllocString
cmp ebx, eax
ja 0x4b87f4
mov eax, ebx
cmp eax, dword [ebp - 4]
ja 0x4b8890
push eax
push dword [ebp - 8]
push esi
call fcn.004b8a76
pop ecx
push eax
call fcn.004c7e37
add esp, 0xc
test eax, eax
je 0x4b88cf
cmp eax, 0xffffffff
je 0x4b88bd
add dword [ebp - 8], eax
sub ebx, eax
sub dword [ebp - 4], eax
jmp 0x4b8854
push esi
call fcn.004c760a
cmp eax, 0xffffffff
pop ecx
je 0x4b88c1
cmp dword [ebp - 4], 0
je 0x4b8890
mov ecx, dword [ebp - 8]
inc dword [ebp - 8]
mov byte [ecx], al
mov eax, dword [esi + 0x18]
dec ebx
dec dword [ebp - 4]
mov dword [ebp - 0xc], eax
test ebx, ebx
jne 0x4b8773
mov eax, dword [ebp + 0x14]
jmp 0x4b870e
xor esi, esi
cmp dword [ebp + 0xc], 0xffffffff
je 0x4b887b
push dword [ebp + 0xc]
push esi
push dword [ebp + 8]
call fcn.004b0a70
add esp, 0xc
call fcn.004b232d
push esi
push esi
push esi
push esi
mov dword [eax], 0x22
push esi
jmp 0x4b8704
cmp dword [ebp + 0xc], 0xffffffff
je 0x4b88a6
push dword [ebp + 0xc]
push 0
push dword [ebp + 8]
call fcn.004b0a70
add esp, 0xc
call fcn.004b232d
mov dword [eax], 0x22
xor eax, eax
push eax
push eax
push eax
push eax
push eax
jmp 0x4b8704
or dword [esi + 0xc], 0x20
mov eax, edi
sub eax, ebx
xor edx, edx
div dword [ebp + 0x10]
jmp 0x4b870e
or dword [esi + 0xc], 0x10
jmp 0x4b88c1
Function at 0x4bf28d
Capabilities:
Write file on windows

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push esi
push edi
xor esi, esi
xor edi, edi
cmp ebx, dword [edi*8 + 0x518a08]
je 0x4bf2a8
inc edi
cmp edi, 0x17
jb 0x4bf299
cmp edi, 0x17
jae 0x4bf428
push ebp
push 3
call fcn.004c9b25
cmp eax, 1
pop ecx
je 0x4bf3f4
push 3
call fcn.004c9b25
test eax, eax
pop ecx
jne 0x4bf2dc
cmp dword [0x518850], 1
je 0x4bf3f4
cmp ebx, 0xfc
je 0x4bf427
push str.Runtime_Error__n_nProgram:
mov ebx, 0x314
push ebx
mov ebp, 0x64caa0
push ebp
call fcn.004b5e25
add esp, 0xc
test eax, eax
je 0x4bf312
push esi
push esi
push esi
push esi
push esi
call fcn.004b3a43
add esp, 0x14
push 0x104
mov esi, 0x64cab9
push esi
push 0
mov byte [0x64cbbd], 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4bf356
push str._program_name_unknown_
push 0x2fb
push esi
call fcn.004b5e25
add esp, 0xc
test eax, eax
je 0x4bf356
xor eax, eax
push eax
push eax
push eax
push eax
push eax
call fcn.004b3a43
add esp, 0x14
push esi
call fcn.004b52f0
inc eax
cmp eax, 0x3c
pop ecx
jbe 0x4bf39b
push esi
call fcn.004b52f0
sub esi, 0x3b
add eax, esi
push 3
mov ecx, 0x64cdb4
push 0x4ec930
sub ecx, eax
push ecx
push eax
call fcn.004b9647
add esp, 0x14
test eax, eax
je 0x4bf39b
xor esi, esi
push esi
push esi
push esi
push esi
push esi
call fcn.004b3a43
add esp, 0x14
jmp 0x4bf39d
xor esi, esi
push 0x4e4798
push ebx
push ebp
call fcn.004b8e92
add esp, 0xc
test eax, eax
je 0x4bf3bd
push esi
push esi
push esi
push esi
push esi
call fcn.004b3a43
add esp, 0x14
push dword [edi*8 + 0x518a0c]
push ebx
push ebp
call fcn.004b8e92
add esp, 0xc
test eax, eax
je 0x4bf3df
push esi
push esi
push esi
push esi
push esi
call fcn.004b3a43
add esp, 0x14
push 0x12010
push str.Microsoft_Visual_C_Runtime_Library
push ebp
call fcn.004c9968
add esp, 0xc
jmp 0x4bf427
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov ebp, eax
cmp ebp, esi
je 0x4bf427
cmp ebp, 0xffffffff
je 0x4bf427
push 0
lea eax, [esp + 0x14]
push eax
lea esi, [edi*8 + 0x518a0c]
push dword [esi]
call fcn.004b52f0
pop ecx
push eax
push dword [esi]
push ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret
Function at 0x4c9968
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.004bdde9
xor ebx, ebx
cmp dword [0x64d490], ebx
mov dword [ebp - 8], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
jne 0x4c9a3e
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x4c9b1e
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x4f2428
push edi
call esi
cmp eax, ebx
je 0x4c9b1e
push eax
call fcn.004bdd7b
mov dword [esp], 0x4f2418
push edi
mov dword [0x64d490], eax
call esi
push eax
call fcn.004bdd7b
mov dword [esp], 0x4f2404
push edi
mov dword [0x64d494], eax
call esi
push eax
call fcn.004bdd7b
mov dword [0x64d498], eax
lea eax, [ebp - 0xc]
push eax
call fcn.004ba3b5
test eax, eax
pop ecx
pop ecx
je 0x4c9a0c
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.004b3a43
add esp, 0x14
cmp dword [ebp - 0xc], 2
jne 0x4c9a3e
push str.GetUserObjectInformationA
push edi
call esi
push eax
call fcn.004bdd7b
cmp eax, ebx
pop ecx
mov dword [0x64d4a0], eax
je 0x4c9a3e
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.004bdd7b
pop ecx
mov dword [0x64d49c], eax
mov eax, dword [0x64d49c]
mov ecx, dword [ebp - 8]
cmp eax, ecx
je 0x4c9ac3
cmp dword [0x64d4a0], ecx
je 0x4c9ac3
push eax
call fcn.004bddf2
push dword [0x64d4a0]
mov esi, eax
call fcn.004bddf2
cmp esi, ebx
pop ecx
pop ecx
mov edi, eax
je 0x4c9ac3
cmp edi, ebx
je 0x4c9ac3
call esi
cmp eax, ebx
je 0x4c9a90
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x4c9a90
test byte [ebp - 0x18], 1
jne 0x4c9ac3
lea eax, [ebp - 0x10]
push eax
call fcn.004ba3ec
test eax, eax
pop ecx
je 0x4c9aab
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.004b3a43
add esp, 0x14
cmp dword [ebp - 0x10], 4
jb 0x4c9aba
or dword [ebp + 0x10], 0x200000
jmp 0x4c9afe
or dword [ebp + 0x10], 0x40000
jmp 0x4c9afe
mov eax, dword [0x64d494]
cmp eax, dword [ebp - 8]
je 0x4c9afe
push eax
call fcn.004bddf2
cmp eax, ebx
pop ecx
je 0x4c9afe
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x4c9afe
mov eax, dword [0x64d498]
cmp eax, dword [ebp - 8]
je 0x4c9afe
push eax
call fcn.004bddf2
cmp eax, ebx
pop ecx
je 0x4c9afe
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x64d490]
call fcn.004bddf2
cmp eax, ebx
pop ecx
je 0x4c9b1e
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x4c9b20
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4cfa7c
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x98
mov eax, dword [0x518860]
xor eax, ebp
mov dword [ebp + 0x74], eax
push esi
mov esi, ecx
call fcn.004cfa11
mov eax, 0x400000
push 0x94
mov dword [esi + 8], eax
mov dword [esi + 4], eax
lea eax, [ebp - 0x20]
push 0
push eax
mov dword [esi], 0x3c
mov byte [esi + 0xc], 0
call fcn.004b0a70
add esp, 0xc
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x20], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x10], 2
jne 0x4cfacb
cmp dword [ebp - 0x1c], 5
jb 0x4cfae3
jmp 0x4cfadf
cmp dword [ebp - 0x10], 1
jne 0x4cfae3
cmp dword [ebp - 0x1c], 4
ja 0x4cfadf
jne 0x4cfae3
cmp dword [ebp - 0x18], 0
jbe 0x4cfae3
mov byte [esi + 0xc], 1
lea ecx, [esi + 0x18]
mov dword [esi + 0x10], 0x800
mov dword [esi + 0x14], 0x4f25e0
call fcn.004cf8e5
test eax, eax
jge 0x4cfb04
mov byte [0x64a24c], 1
mov ecx, dword [ebp + 0x74]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.004b5576
add ebp, 0x78
leave
ret
Function at 0x1000f8f0
Capabilities:
Encode data using xor

Disassembly:
test dword [ebp + 0x31], edx
mov ecx, 0xa9f0ee3a
xor dword [ecx - 0x560f11c6], edi
xor eax, 0xde6dab31
nop
xchg edi, eax
imul edx, esi, 0x486474fb
dec eax
jge 0x1000f886
lodsd eax, dword [esi]
dec ebp
sahf
adc ecx, dword [ebp - 0x2c]
retf 0xad0a
inc edx
xor dword [ebp + 0x8080bac], ebp
add esi, esp
inc esi
add ecx, dword [edx]
jo 0x1000f8c7
xchg esp, eax
jbe 0x1000f897
cld
sbb byte [ecx + 0x4f], cl
mov al, 0x12
push 0xffffffffffffffc8
jnp 0x1000f884
jae 0x1000f93d
sub al, 0x65
jl 0x1000f8a1
dec edx
adc al, 0xb5
and al, 0x4d
fdiv qword [esi - 0x4904a80c]
cmpsd dword [esi], dword es:[edi]
sub ebx, 0xd9fe30cf
dec ecx
cmp dl, byte [ebx + 0x5c27df50]
fbld tbyte [edi]
pop esp
jmp 0x1000f8b8
xor dh, bh
invalid
fbld tbyte [edi]
pop esp
outsd dx, dword [esi]
mov eax, eax
xor eax, 0x5bbb86b9
test byte [edi], ah
daa
mov cl, 0x7d
pop ecx
jp 0x1000f8e9
sbb byte [eax - 9], ah
salc
jns 0x1000f95d
nop
imul edx, dword [esi + eax - 0x28], 0xffffffff
test byte [ebx + 0x4089a65f], ch
add ecx, esi
outsd dx, dword [esi]
add byte [bp + 0x2bf2], dl
pop ss
pop es
dec ebx
adc byte [ebx + 0x6ab8c945], dh
xor byte [eax + 0x47e5950b], dh
mov eax, dword [0x815fe28e]
xchg ecx, eax
xor edx, ebx
mov al, 0xeb
fsub dword [eax + esi*2 + 0x23]
test dword [edx], ecx
pop ecx
jp 0x1000f8fc
mov esi, 0xed94a4b2
mov dl, 0xa4
xchg esp, eax
in eax, dx
daa
mov eax, dword [0xedf68fa1]
out 0xb3, al
mov al, byte [0xd113d0fb]
sub dword [edi], ecx
sti
jecxz 0x1000f8e7
xor edi, dword [edx + 0x2403c89d]
push eax
pop esi
mov fs, word [ebp - 0x19fb063d]
cmp ah, byte [esi + 0x5bd04421]
loope 0x1000f985
movsb byte es:[edi], byte [esi]
ret
int3
int 0x99
push ds
push ecx
mov al, byte [0xe1375ff0]
xchg edi, eax
inc eax
aad 0x32
mov edx, 0x338c2427
sti
fsubr st(0)
fnstcw word ss:[ebx + ebx*4 + 0x5eb09ee5]
lea eax, [esp + esi*4]
sbb ecx, dword [esi - 0x9fd1850]
push es
fisub word [edi + 0xd248009]
push ebp
mov bl, ch
dec edx
mov esi, 0xa2048ee8
lahf
mov eax, 0x420e4766
pushal
in al, 0x67
scasb al, byte es:[edi]
invalid
Function at 0x1001e3d0
Capabilities:
Encode data using xor

Disassembly:
pop esi
and dh, byte [ebx + ecx*4 - 0x28ad4446]
pop esi
jle 0x1001e3db
daa
aaa
outsd dx, dword [esi]
xor esi, dword [edi + 0x31]
inc edx
or dword [edi + 0x64d13b85], 0xfffffffa
cli
fsubr qword [ebx + 0x36]
xor al, 0xe8
and edi, dword [eax + 2]
push ebp
call 0x65045bed
call [edi - 7]
cmp dword [esi + ebp*2 - 0x64], esp
pushfd
pushfd
pop ecx
inc eax
loopne 0x1001e3a7
jge 0x1001e3df
adc byte [ecx], dl
sbb bl, byte [ebp + 0x3cfbd268]
push 0x53cfbd2
adc edi, dword [esi - 0x77]
call 0xfbe1773f
add eax, 0xe8897e13
push edi
xchg ebx, eax
fucompi st(3)
cmp ch, byte [ebx + 0x810d23a]
pushfd
stc
jbe 0x1001e3c5
and byte [ebx + 0x13924df8], dl
adc byte [ebx - 0x2474b14], dh
or al, 0x2e
sbb eax, 0x9cccc2fc
loopne 0x1001e433
or eax, 0xc0743e1c
daa
sbb dword [edi + 0x1c], esi
xor dword [eax], edx
mov dl, 0x54
insd dword es:[edi], dx
aas
pop es
dec ebp
add dl, byte [eax + 0x6b6fd436]
or cl, ch
lds eax, [edi + 0x4a]
dec edx
scasb al, byte es:[edi]
dec ecx
cmc
and byte [eax - 0x56b98799], 0xe2
mov esp, 0x12f08ffe
jno 0x1001e445
adc dh, byte [ecx + 0xf]
loopne 0x1001e443
pop edx
cld
adc byte [ebx], ah
dec edx
jecxz 0x1001e4ba
cmc
mov edx, 0x46ba71b8
mov edx, 0xc4746b46
mov dh, 0xe1
imul esi, dword [esp + eax*8 - 0x4a], 0xffffffe1
outsd dx, dword [esi]
adc byte [edi + ebx*4 + 0x100d5a51], bh
test dword [ebx], ecx
test dword [ebx + edx*4], ebx
aad 0x81
xchg ebp, eax
xchg edi, eax
xchg dword [eax - 0x61], ebx
inc esp
dec dword [eax + 0x792978cb]
sbb dword [ebx], ecx
push es
cmpsd dword [esi], dword es:[edi]
popal
mov ecx, 0x1654c93a
mov esi, 0xaff3db97
or al, 0x1b
ror eax, 1
sahf
push ecx
cmp eax, 0xd1a1713c
xor eax, 0x31c2c62d
jge 0x1001e459
rcl dh, 0x89
add esp, dword [edi - 0x350c8c7]
ljmp 0xdfc8
retf
or byte [edx], bh
sub dword [eax + 0x4cf477a5], esp
movsd dword es:[edi], dword [esi]
ja 0x1001e4b5
dec esp
test eax, 0xe2bc9a7d
jb 0x1001e4fe
iretd
add eax, 0x878448f6
pop es
fiadd word [ebp + 0x77d34e5d]
push esi
sub eax, 0x4ee66e54
mov ebx, dword [ecx + 0x3a3a5f8e]
movsb byte es:[edi], byte [esi]
adc byte [eax], bh
xchg edi, eax
aas
xlatb
or al, 0x31
cmp byte [edi + 0x310cd73f], dl
xor edx, dword [ebx]
lahf
jae 0x1001e53b
add eax, 0x4c09c7c9
jp 0x1001e4be
enter 0x5c3, 0xffffffffffffff9a
call 0xc909e97f
jbe 0x1001e4c9
mov bh, 0x76
aam 0x4c
cmpsd dword [esi], dword es:[edi]
and eax, 0x57d7fdb4
mov ebp, dword [ebx]
loop 0x1001e519
dec ebx
cmc
mov cl, 0x8f
adc byte [esi - 0x6f], dh
iretd

Function at 0x1001faa0
Capabilities:
Encode data using xor

Disassembly:
or al, 0x80
imul esi, dword [ebx - 0xaffb25d], 0xffffff9e
xchg ebp, eax
mov ebx, 0xddc989b3
fldcw word [ecx - 0x248c00ad]
add byte [esi - 0x160dd004], al
cmp eax, 0xafce278d
xor al, 0xed
add dword [esi], eax
xor eax, 0x901bf75b
jne 0x1001fabb
or byte [ecx - 0x19], bl
xchg eax, ecx
ret 0x6bed
Function at 0x10527058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.105271a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x1052707e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x1052706a
add dl, dl
jne 0x10527089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x105270dc
xor eax, eax
add dl, dl
jne 0x10527096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x1052717d
add dl, dl
jne 0x105270a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x105270b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x105270bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x105270c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x105270d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x10527075
mov eax, 1
add dl, dl
jne 0x105270ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x105270f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x105270e1
sub eax, ebx
mov ebx, 1
jne 0x10527128
mov ecx, 1
add dl, dl
jne 0x1052710e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x10527119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x10527105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x10527075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x1052713f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1052714a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x10527136
cmp eax, 0x7d00
jae 0x1052716d
cmp eax, 0x500
jb 0x10527168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x10527075
cmp eax, 0x7f
ja 0x10527170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x10527075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x1052719e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x10527075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10

Function at 0x433005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
call 0x43300c
nop
nop
nop
nop
nop
pop eax
nop
add eax, 0x40a063
nop
sub eax, 0x40a009
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x433030
nop
add eax, 0xc
nop
nop
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
jne 0x43301e
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0x404a60
Capabilities:
Resolve function by parsing pe exports

Disassembly:
jmp 0x404a03
movzx ecx, word [edx + 0x26]
jmp 0x404a12
mov esi, dword [edx + 0x28]
nop
jmp 0x404a23
xor edi, edi
jmp 0x404a33
jmp 0x404a3d
xor eax, eax
lodsb al, byte [esi]
cmp al, 0x61
nop
jmp 0x404a4d
jl 0x404a6d
jmp fcn.00404a60
nop
jmp 0x404a6b
sub al, 0x20
nop
jmp 0x404a7f
ror edi, 0xd
add edi, eax
nop
jmp 0x404a96
dec ecx
nop
jne 0x404a33
jmp 0x404aaf
push edx
nop
jmp 0x404ac1
push edi
mov edx, dword [edx + 0x10]
nop
jmp 0x404ad4
mov eax, dword [edx + 0x3c]
nop
add eax, edx
nop
jmp 0x404ae9
mov eax, dword [eax + 0x78]
test eax, eax
nop
je 0x404cde
nop
add eax, edx
nop
jmp 0x404b07
push eax
nop
jmp 0x404b14
mov ecx, dword [eax + 0x18]
jmp 0x404b25
mov ebx, dword [eax + 0x20]
nop
jmp 0x404b35
add ebx, edx
nop
jmp 0x404b44
test ecx, ecx
jmp 0x404b57
je 0x404ccc
jmp 0x404b6b
dec ecx
xor edi, edi
jmp 0x404b7b
mov esi, dword [ebx + ecx*4]
nop
add esi, edx
nop
jmp 0x404b8f
jmp 0x404b9b
xor eax, eax
lodsb al, byte [esi]
jmp 0x404baa
ror edi, 0xd
nop
jmp 0x404bb9
add edi, eax
nop
cmp al, ah
nop
jmp 0x404bd2
jne 0x404b8f
jmp 0x404be6
add edi, dword [ebp - 8]
nop
cmp edi, dword [ebp + 0x24]
jmp 0x404c00
jne 0x404b37
nop
jmp 0x404c18
jmp 0x404c27
pop eax
nop
jmp 0x404c3a
mov ebx, dword [eax + 0x24]
jmp 0x404c4c
add ebx, edx
jmp 0x404c5d
mov cx, word [ebx + ecx*2]
mov ebx, dword [eax + 0x1c]
nop
add ebx, edx
jmp 0x404c7b
mov eax, dword [ebx + ecx*4]
jmp 0x404c8b
add eax, edx
nop
mov dword [esp + 0x24], eax
pop ebx
nop
jmp 0x404ca5
pop ebx
popal
pop ecx
pop edx
push ecx
jmp 0x404cba
jmp eax
nop
pop eax
nop
jmp 0x404cde
pop edi
nop
pop edx
nop
jmp 0x404cf6
mov edx, dword [edx]
jmp 0x4049f2

Function at 0x404abc
Capabilities:
Resolve function by parsing pe exports

Disassembly:
invalid
jg 0x404a9b
push 0x8b574b0d
push edx
adc byte [eax - 0x7c4cf315], dl
inc ebx
mov ecx, 0x6b091c2
shl edx, cl
pop ds
mov eax, dword [edx + 0x3c]
Function at 0x631db0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x22c000]
push edi
jmp 0x631dca
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x631dd1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x631dc0
mov eax, 1
add ebx, ebx
jne 0x631de3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x631df4
jne 0x631e13
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x631e13
dec eax
add ebx, ebx
jne 0x631e00
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x631dd8
add ebx, ebx
jne 0x631e0f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x631e65
xor ecx, ecx
sub eax, 3
jb 0x631e2b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x631e9a
sar eax, 1
mov ebp, eax
jmp 0x631e36
add ebx, ebx
jne 0x631e36
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x631e04
inc ecx
add ebx, ebx
jne 0x631e44
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x631e04
add ebx, ebx
jne 0x631e51
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x631e46
jne 0x631e62
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x631e46
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x631e84
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x631e76
jmp 0x631dc6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x631e84
add edi, ecx
jmp 0x631dc6
pop esi
mov edi, esi
mov ecx, 0x255
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x631ea2
cmp byte [edi], 1
jne 0x631ea2
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x631ea7
lea edi, [esi + 0x22f000]
mov eax, dword [edi]
or eax, eax
je 0x631f1f
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x25236c]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x252420]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x631ed4
mov ecx, edi
jns 0x631f03
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x252424]
or eax, eax
je 0x631f19
mov dword [ebx], eax
add ebx, 4
jmp 0x631ef1
call dword [esi + 0x252434]
mov ebp, dword [esi + 0x252428]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1ff]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x631f53
sub esp, 0xffffff80
jmp 0x40354b